pkgxray 0.8.0 → 0.8.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pkgxray",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Zero-dep local CLI and MCP server that scans npm packages for supply-chain risk. OSV vuln pre-check, sandboxed quarantine, tarball-integrity verification, calibrated static heuristics, GitHub provenance cross-check.",
   "license": "MIT",
   "author": "Jack Adams-Lovell",

package/src/diff.js

@@ -156,6 +156,18 @@ async function diffNpmVsGithub({ npmStagedPath, githubStagedPath, subdir, hasBui
     };
   }
 
+  // Pre-compute the set of directories that EXIST in github. We use this to
+  // decide whether an extra file is in a "real source dir" (sibling source
+  // files exist in github) or in a path github doesn't have at all (more
+  // likely build output).
+  const ghDirs = new Set();
+  for (const ghPath of ghTree.keys()) {
+    const parts = ghPath.split("/");
+    for (let i = 1; i < parts.length; i += 1) {
+      ghDirs.add(parts.slice(0, i).join("/"));
+    }
+  }
+
   const extraInNpm = [];
   const mismatched = [];
   const matched = [];
@@ -164,20 +176,25 @@ async function diffNpmVsGithub({ npmStagedPath, githubStagedPath, subdir, hasBui
     if (isAlwaysIgnored(rel)) continue;
     const ghEntry = ghTree.get(rel);
     if (!ghEntry) {
-      // Files in the npm tarball but NOT in the github repo at the matching
-      // ref. If the package has a build script, root-level JS at non-source
-      // paths is probably bundled / generated and we can't reliably catch
-      // tampering there — demote to silent. We DO still surface extras in
-      // paths that look like source trees (`src/`, `lib/`, `tests/`,
-      // `scripts/`) since those should be 1:1 even with a build step.
+      const parentDir = rel.includes("/") ? rel.split("/").slice(0, -1).join("/") : "";
+      const parentExistsInGh = parentDir === "" || ghDirs.has(parentDir);
+      // An extra file inside a directory that exists in github is the strong
+      // ATO signal — github has the dir, the attacker just dropped one more
+      // file in it. An extra file at a path github doesn't have at all is
+      // more likely build output the repo never committed.
       const inLikelySourceDir = /^(?:src|tests?|scripts|spec)\//.test(rel);
-      const category = isBuildOutput(rel)
-        ? hasBuildScript ? "expected-build-output" : "extra-build-output"
-        : isSourceFile(rel)
-          ? hasBuildScript && !inLikelySourceDir
-            ? "expected-build-output"
-            : "extra-source"
-          : "extra-other";
+      let category;
+      if (parentExistsInGh && isSourceFile(rel)) {
+        category = "extra-source";
+      } else if (isBuildOutput(rel)) {
+        category = hasBuildScript ? "expected-build-output" : "extra-build-output";
+      } else if (isSourceFile(rel)) {
+        category = hasBuildScript && !inLikelySourceDir
+          ? "expected-build-output"
+          : "extra-source";
+      } else {
+        category = "extra-other";
+      }
       extraInNpm.push({ path: rel, category, size: npmEntry.size });
       continue;
     }

package/src/github.js

@@ -49,7 +49,9 @@ function parseGithubRepo(repository) {
     /^github:([^/]+)\/(.+)$/,
     /^(?:https?|git):\/\/github\.com\/([^/]+)\/([^/?#]+)/,
     /^git@github\.com:([^/]+)\/([^/?#]+)/,
-    /^ssh:\/\/git@github\.com\/([^/]+)\/([^/?#]+)/
+    /^ssh:\/\/git@github\.com\/([^/]+)\/([^/?#]+)/,
+    // npm shorthand: bare "owner/repo" defaults to GitHub
+    /^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)$/
   ];
   for (const pattern of patterns) {
     const match = cleaned.match(pattern);

package/src/quarantine.js

@@ -111,7 +111,7 @@ async function guardExtension(reference, options = {}) {
   let npmVsGithubDiff = null;
   if (
     options.githubDiff !== false &&
-    resolved.type === "npm" &&
+    (resolved.type === "npm" || resolved.type === "local") &&
     githubMetadata && githubMetadata.found &&
     vulnerabilities.length === 0 &&
     Object.keys(sourceFiles).length > 0
@@ -224,10 +224,33 @@ async function stageReference(reference, stagedPath, options) {
   const parsed = parseReference(reference);
   if (parsed.type === "local") {
     await copyLocalPath(parsed.path, stagedPath);
+    // Populate npmMetadata from the staged package.json so downstream phases
+    // (github metadata cross-check, npm-vs-github diff) can work on local
+    // packages too.
+    let npmMetadata = null;
+    let packageName = path.basename(parsed.path);
+    let version = null;
+    try {
+      const pkg = JSON.parse(await fsp.readFile(path.join(stagedPath, "package.json"), "utf8"));
+      packageName = pkg.name || packageName;
+      version = pkg.version || null;
+      if (pkg.repository) {
+        npmMetadata = {
+          name: pkg.name || packageName,
+          version: pkg.version || null,
+          repository: pkg.repository,
+          maintainers: []
+        };
+      }
+    } catch {
+      // no package.json or unparseable — fine, just no metadata
+    }
     return {
       type: "local",
       source: parsed.path,
-      packageName: path.basename(parsed.path)
+      packageName,
+      version,
+      npmMetadata
     };
   }