weavatrix 0.1.0 → 0.1.2

package/src/security/malware-heuristics.exclusions.js

@@ -1,134 +1,134 @@
-// Allowlist/exclusion parsing and URL/doc-noise filters for the malware scanner (split out of
-// malware-heuristics.js; see that file for the scanner overview).
-import { NOISY_URL_KEYS, isDocFile, isBenignUrlContext } from "./registry-sig.js";
-
-export const normPath = (p) => String(p || "").replace(/\\/g, "/").replace(/\/+$/, "");
-const URL_RULE_KEYS = new Set(["exfil-url", "exfil-ip", "cloud-metadata-url", "network-url", "hardcoded-url"]);
-const URL_RE = /https?:\/\/[^\s'"`)\\<>]+/gi;
-const PACKAGE_JSON_SCRIPT_RE = /["']?(preinstall|install|postinstall|prepare|prepack|postpack|prepublish|prepublishonly)["']?\s*:/i;
-const PACKAGE_JSON_METADATA_URL_RE = /["']?(bugs|homepage|repository|funding|author|contributors|maintainers|publishConfig|license)["']?\s*:|["']?url["']?\s*:/i;
-const NETWORK_CALL_RE = /\b(fetch|axios\.|XMLHttpRequest|sendBeacon|https?\.request|request\(|curl\b|wget\b|iwr\b|invoke-webrequest)\b/i;
-const LIFECYCLE_SCRIPT_HOOKS = ["preinstall", "install", "postinstall", "prepare"];
-
-function cleanUrlToken(value) {
-  return String(value || "").trim().replace(/[.,;:!?]+$/g, "").replace(/[)\]}]+$/g, "");
-}
-
-function splitAllowlistText(value) {
-  if (Array.isArray(value)) return value.flatMap(splitAllowlistText);
-  return String(value || "")
-    .split(/[\r\n,]+/)
-    .map((line) => line.replace(/\s+#.*$/, "").trim())
-    .filter(Boolean);
-}
-
-function normalizeHost(value) {
-  let s = String(value || "").trim().toLowerCase();
-  if (!s) return "";
-  try {
-    if (/^https?:\/\//i.test(s)) s = new URL(s).host;
-  } catch { /* keep raw */ }
-  return s.replace(/^\*\./, "").replace(/^\./, "").replace(/:\d+$/, "");
-}
-
-function normalizeUrl(value) {
-  const raw = cleanUrlToken(value);
-  if (!raw) return "";
-  try {
-    const u = new URL(raw);
-    const path = u.pathname.replace(/\/+$/, "");
-    return `${u.protocol.toLowerCase()}//${u.host.toLowerCase()}${path}${u.search || ""}`;
-  } catch {
-    return raw.toLowerCase().replace(/\/+$/, "");
-  }
-}
-
-function extractUrls(text) {
-  return [...String(text || "").matchAll(URL_RE)].map((m) => cleanUrlToken(m[0])).filter(Boolean);
-}
-
-function urlMatchesAllow(allowUrl, candidate) {
-  const a = normalizeUrl(allowUrl);
-  const c = normalizeUrl(candidate);
-  if (!a || !c) return false;
-  return c === a || c.startsWith(`${a}/`) || a.startsWith(`${c}/`);
-}
-
-function hostMatchesAllow(allowHost, candidate) {
-  const a = normalizeHost(allowHost);
-  const c = normalizeHost(candidate);
-  return !!(a && c && (c === a || c.endsWith(`.${a}`)));
-}
-
-export function parseMalwareExclusions(input = {}) {
-  const out = { urls: [], hosts: [], packages: [], rules: [] };
-  const add = (raw) => {
-    const s = cleanUrlToken(raw);
-    if (!s) return;
-    const lower = s.toLowerCase();
-    if (lower.startsWith("pkg:")) { out.packages.push(s.slice(4).trim()); return; }
-    if (lower.startsWith("package:")) { out.packages.push(s.slice(8).trim()); return; }
-    if (lower.startsWith("rule:")) { out.rules.push(s.slice(5).trim()); return; }
-    if (lower.startsWith("host:")) { out.hosts.push(normalizeHost(s.slice(5))); return; }
-    if (lower.startsWith("domain:")) { out.hosts.push(normalizeHost(s.slice(7))); return; }
-    if (/^https?:\/\//i.test(s)) { out.urls.push(normalizeUrl(s)); out.hosts.push(normalizeHost(s)); return; }
-    if (!s.includes("/") && s.includes(".")) { out.hosts.push(normalizeHost(s)); return; }
-    out.packages.push(s);
-  };
-  if (typeof input === "string" || Array.isArray(input)) {
-    for (const line of splitAllowlistText(input)) add(line);
-  } else if (input && typeof input === "object") {
-    for (const line of splitAllowlistText(input.urls || input.url || "")) add(line);
-    for (const line of splitAllowlistText(input.domains || input.domain || "")) add(`host:${line}`);
-    for (const line of splitAllowlistText(input.packages || input.package || "")) add(/^pkg(age)?:/i.test(line) ? line : `pkg:${line}`);
-    for (const line of splitAllowlistText(input.rules || input.rule || "")) add(`rule:${line}`);
-  }
-  return {
-    urls: [...new Set(out.urls.filter(Boolean))],
-    hosts: [...new Set(out.hosts.filter(Boolean))],
-    packages: [...new Set(out.packages.map((p) => p.trim()).filter(Boolean))],
-    rules: [...new Set(out.rules.map((r) => r.trim()).filter(Boolean))],
-  };
-}
-
-export function isManifestUrlNoise(file, signal) {
-  if (!URL_RULE_KEYS.has(signal?.key)) return false;
-  const f = normPath(file).toLowerCase();
-  const text = `${signal?.snippet || ""}`.trim();
-  if (/(^|\/)package\.json$/.test(f)) {
-    if (PACKAGE_JSON_SCRIPT_RE.test(text)) return false;
-    return PACKAGE_JSON_METADATA_URL_RE.test(text) || !NETWORK_CALL_RE.test(text);
-  }
-  return /(^|\/)(pkg-info|metadata)$/.test(f);
-}
-
-export function lifecycleScriptSnippet(scripts = {}) {
-  for (const hook of LIFECYCLE_SCRIPT_HOOKS) {
-    const s = String(scripts?.[hook] || "").trim();
-    if (s) return `${hook}: ${s}`.slice(0, 200);
-  }
-  return "";
-}
-
-// weak URL rules only: URL evidence in a license/prose file or in comment/doc-link context is
-// documentation, not behavior (LICENSE:5 "http://www.apache.org/licenses/" was the hot FP).
-// Strong rules (miner/shell/exfil-url) are untouched and still scan those same files.
-export function isDocUrlNoise(file, signal) {
-  if (!NOISY_URL_KEYS.has(signal?.key)) return false;
-  return isDocFile(file) || isBenignUrlContext(signal?.snippet || "");
-}
-
-export function isMalwareSignalExcluded(pkg, signal, exclusions = {}) {
-  const ex = exclusions.urls || exclusions.hosts || exclusions.packages || exclusions.rules ? exclusions : parseMalwareExclusions(exclusions);
-  if (signal?.key && ex.rules.includes(signal.key)) return true;
-  if (ex.packages.some((p) => p.toLowerCase() === String(pkg || "").toLowerCase()) && signal?.noisy) return true;
-  if (!URL_RULE_KEYS.has(signal?.key)) return false;
-  const text = `${signal?.snippet || ""}\n${signal?.file || ""}`;
-  const urls = extractUrls(text);
-  for (const url of urls) {
-    if (ex.urls.some((allowed) => urlMatchesAllow(allowed, url))) return true;
-    if (ex.hosts.some((allowed) => hostMatchesAllow(allowed, url))) return true;
-  }
-  if (!urls.length && ex.hosts.some((host) => host && text.toLowerCase().includes(host))) return true;
-  return false;
-}
+// Allowlist/exclusion parsing and URL/doc-noise filters for the malware scanner (split out of
+// malware-heuristics.js; see that file for the scanner overview).
+import { NOISY_URL_KEYS, isDocFile, isBenignUrlContext } from "./registry-sig.js";
+
+export const normPath = (p) => String(p || "").replace(/\\/g, "/").replace(/\/+$/, "");
+const URL_RULE_KEYS = new Set(["exfil-url", "exfil-ip", "cloud-metadata-url", "network-url", "hardcoded-url"]);
+const URL_RE = /https?:\/\/[^\s'"`)\\<>]+/gi;
+const PACKAGE_JSON_SCRIPT_RE = /["']?(preinstall|install|postinstall|prepare|prepack|postpack|prepublish|prepublishonly)["']?\s*:/i;
+const PACKAGE_JSON_METADATA_URL_RE = /["']?(bugs|homepage|repository|funding|author|contributors|maintainers|publishConfig|license)["']?\s*:|["']?url["']?\s*:/i;
+const NETWORK_CALL_RE = /\b(fetch|axios\.|XMLHttpRequest|sendBeacon|https?\.request|request\(|curl\b|wget\b|iwr\b|invoke-webrequest)\b/i;
+const LIFECYCLE_SCRIPT_HOOKS = ["preinstall", "install", "postinstall", "prepare"];
+
+function cleanUrlToken(value) {
+  return String(value || "").trim().replace(/[.,;:!?]+$/g, "").replace(/[)\]}]+$/g, "");
+}
+
+function splitAllowlistText(value) {
+  if (Array.isArray(value)) return value.flatMap(splitAllowlistText);
+  return String(value || "")
+    .split(/[\r\n,]+/)
+    .map((line) => line.replace(/\s+#.*$/, "").trim())
+    .filter(Boolean);
+}
+
+function normalizeHost(value) {
+  let s = String(value || "").trim().toLowerCase();
+  if (!s) return "";
+  try {
+    if (/^https?:\/\//i.test(s)) s = new URL(s).host;
+  } catch { /* keep raw */ }
+  return s.replace(/^\*\./, "").replace(/^\./, "").replace(/:\d+$/, "");
+}
+
+function normalizeUrl(value) {
+  const raw = cleanUrlToken(value);
+  if (!raw) return "";
+  try {
+    const u = new URL(raw);
+    const path = u.pathname.replace(/\/+$/, "");
+    return `${u.protocol.toLowerCase()}//${u.host.toLowerCase()}${path}${u.search || ""}`;
+  } catch {
+    return raw.toLowerCase().replace(/\/+$/, "");
+  }
+}
+
+function extractUrls(text) {
+  return [...String(text || "").matchAll(URL_RE)].map((m) => cleanUrlToken(m[0])).filter(Boolean);
+}
+
+function urlMatchesAllow(allowUrl, candidate) {
+  const a = normalizeUrl(allowUrl);
+  const c = normalizeUrl(candidate);
+  if (!a || !c) return false;
+  return c === a || c.startsWith(`${a}/`) || a.startsWith(`${c}/`);
+}
+
+function hostMatchesAllow(allowHost, candidate) {
+  const a = normalizeHost(allowHost);
+  const c = normalizeHost(candidate);
+  return !!(a && c && (c === a || c.endsWith(`.${a}`)));
+}
+
+export function parseMalwareExclusions(input = {}) {
+  const out = { urls: [], hosts: [], packages: [], rules: [] };
+  const add = (raw) => {
+    const s = cleanUrlToken(raw);
+    if (!s) return;
+    const lower = s.toLowerCase();
+    if (lower.startsWith("pkg:")) { out.packages.push(s.slice(4).trim()); return; }
+    if (lower.startsWith("package:")) { out.packages.push(s.slice(8).trim()); return; }
+    if (lower.startsWith("rule:")) { out.rules.push(s.slice(5).trim()); return; }
+    if (lower.startsWith("host:")) { out.hosts.push(normalizeHost(s.slice(5))); return; }
+    if (lower.startsWith("domain:")) { out.hosts.push(normalizeHost(s.slice(7))); return; }
+    if (/^https?:\/\//i.test(s)) { out.urls.push(normalizeUrl(s)); out.hosts.push(normalizeHost(s)); return; }
+    if (!s.includes("/") && s.includes(".")) { out.hosts.push(normalizeHost(s)); return; }
+    out.packages.push(s);
+  };
+  if (typeof input === "string" || Array.isArray(input)) {
+    for (const line of splitAllowlistText(input)) add(line);
+  } else if (input && typeof input === "object") {
+    for (const line of splitAllowlistText(input.urls || input.url || "")) add(line);
+    for (const line of splitAllowlistText(input.domains || input.domain || "")) add(`host:${line}`);
+    for (const line of splitAllowlistText(input.packages || input.package || "")) add(/^pkg(age)?:/i.test(line) ? line : `pkg:${line}`);
+    for (const line of splitAllowlistText(input.rules || input.rule || "")) add(`rule:${line}`);
+  }
+  return {
+    urls: [...new Set(out.urls.filter(Boolean))],
+    hosts: [...new Set(out.hosts.filter(Boolean))],
+    packages: [...new Set(out.packages.map((p) => p.trim()).filter(Boolean))],
+    rules: [...new Set(out.rules.map((r) => r.trim()).filter(Boolean))],
+  };
+}
+
+export function isManifestUrlNoise(file, signal) {
+  if (!URL_RULE_KEYS.has(signal?.key)) return false;
+  const f = normPath(file).toLowerCase();
+  const text = `${signal?.snippet || ""}`.trim();
+  if (/(^|\/)package\.json$/.test(f)) {
+    if (PACKAGE_JSON_SCRIPT_RE.test(text)) return false;
+    return PACKAGE_JSON_METADATA_URL_RE.test(text) || !NETWORK_CALL_RE.test(text);
+  }
+  return /(^|\/)(pkg-info|metadata)$/.test(f);
+}
+
+export function lifecycleScriptSnippet(scripts = {}) {
+  for (const hook of LIFECYCLE_SCRIPT_HOOKS) {
+    const s = String(scripts?.[hook] || "").trim();
+    if (s) return `${hook}: ${s}`.slice(0, 200);
+  }
+  return "";
+}
+
+// weak URL rules only: URL evidence in a license/prose file or in comment/doc-link context is
+// documentation, not behavior (LICENSE:5 "http://www.apache.org/licenses/" was the hot FP).
+// Strong rules (miner/shell/exfil-url) are untouched and still scan those same files.
+export function isDocUrlNoise(file, signal) {
+  if (!NOISY_URL_KEYS.has(signal?.key)) return false;
+  return isDocFile(file) || isBenignUrlContext(signal?.snippet || "");
+}
+
+export function isMalwareSignalExcluded(pkg, signal, exclusions = {}) {
+  const ex = exclusions.urls || exclusions.hosts || exclusions.packages || exclusions.rules ? exclusions : parseMalwareExclusions(exclusions);
+  if (signal?.key && ex.rules.includes(signal.key)) return true;
+  if (ex.packages.some((p) => p.toLowerCase() === String(pkg || "").toLowerCase()) && signal?.noisy) return true;
+  if (!URL_RULE_KEYS.has(signal?.key)) return false;
+  const text = `${signal?.snippet || ""}\n${signal?.file || ""}`;
+  const urls = extractUrls(text);
+  for (const url of urls) {
+    if (ex.urls.some((allowed) => urlMatchesAllow(allowed, url))) return true;
+    if (ex.hosts.some((allowed) => hostMatchesAllow(allowed, url))) return true;
+  }
+  if (!urls.length && ex.hosts.some((host) => host && text.toLowerCase().includes(host))) return true;
+  return false;
+}

package/src/security/malware-heuristics.js

@@ -1,15 +1,15 @@
-// Heuristic malware scanner over INSTALLED dependencies (defensive): install-script beacons, crypto-
-// miner signatures, exfiltration endpoints, obfuscation markers, non-registry install sources.
-// Phase A (always, cheap): every installed package's package.json scripts + lockfile `resolved` origin.
-// Phase B (content): ripgrep sweep of node_modules when rg is available (full coverage), else a bounded
-// Node fallback over each package's entry files. Multi-signal scoring per package: high/critical needs
-// a near-zero-FP rule OR >=2 independent rule keys; the allowlist downgrades ONLY noisy rules.
-// This catches known PATTERNS — it is not a sandbox or a reputation service (honest limit, in the UI).
-// Split into sibling modules (this file stays the import path):
-//   malware-heuristics.exclusions.js - allowlist parsing + URL/doc noise filters
-//   malware-heuristics.roots.js      - content roots + path-to-package mapping
-//   malware-heuristics.sweep.js      - ripgrep / Node content sweeps
-//   malware-heuristics.scan.js       - scanMalware orchestration
-export { parseMalwareExclusions, isMalwareSignalExcluded } from "./malware-heuristics.exclusions.js";
-export { pkgOfNodeModulesPath } from "./malware-heuristics.roots.js";
-export { scanMalware } from "./malware-heuristics.scan.js";
+// Heuristic malware scanner over INSTALLED dependencies (defensive): install-script beacons, crypto-
+// miner signatures, exfiltration endpoints, obfuscation markers, non-registry install sources.
+// Phase A (always, cheap): every installed package's package.json scripts + lockfile `resolved` origin.
+// Phase B (content): ripgrep sweep of node_modules when rg is available (full coverage), else a bounded
+// Node fallback over each package's entry files. Multi-signal scoring per package: high/critical needs
+// a near-zero-FP rule OR >=2 independent rule keys; the allowlist downgrades ONLY noisy rules.
+// This catches known PATTERNS — it is not a sandbox or a reputation service (honest limit, in the UI).
+// Split into sibling modules (this file stays the import path):
+//   malware-heuristics.exclusions.js - allowlist parsing + URL/doc noise filters
+//   malware-heuristics.roots.js      - content roots + path-to-package mapping
+//   malware-heuristics.sweep.js      - ripgrep / Node content sweeps
+//   malware-heuristics.scan.js       - scanMalware orchestration
+export { parseMalwareExclusions, isMalwareSignalExcluded } from "./malware-heuristics.exclusions.js";
+export { pkgOfNodeModulesPath } from "./malware-heuristics.roots.js";
+export { scanMalware } from "./malware-heuristics.scan.js";

package/src/security/malware-heuristics.roots.js

@@ -1,142 +1,142 @@
-// Content roots + path-to-package mapping for the malware scanner (split out of
-// malware-heuristics.js): npm node_modules, Python site-packages, Go vendor/ and module cache.
-import { readFileSync, readdirSync, existsSync, statSync } from "node:fs";
-import { homedir } from "node:os";
-import { delimiter, join, relative } from "node:path";
-import { normPath } from "./malware-heuristics.exclusions.js";
-
-const pep503 = (name) => String(name || "").toLowerCase().replace(/[-_.]+/g, "-");
-
-// node_modules/@scope/name/... → @scope/name ; node_modules/name/... → name
-export function pkgOfNodeModulesPath(p) {
-  const s = String(p).replace(/\\/g, "/");
-  const i = s.lastIndexOf("node_modules/");
-  if (i < 0) return "";
-  const rest = s.slice(i + "node_modules/".length).split("/");
-  return rest[0]?.startsWith("@") ? `${rest[0]}/${rest[1] || ""}` : rest[0] || "";
-}
-
-function existingDir(p) {
-  try { return p && existsSync(p) && statSync(p).isDirectory(); } catch { return false; }
-}
-
-function sitePackageRoots(repoPath) {
-  const roots = [];
-  for (const venv of [".venv", "venv", "env"]) {
-    const win = join(repoPath, venv, "Lib", "site-packages");
-    if (existingDir(win)) roots.push(win);
-    try {
-      for (const d of readdirSync(join(repoPath, venv, "lib"))) {
-        const posix = join(repoPath, venv, "lib", String(d), "site-packages");
-        if (/^python/i.test(String(d)) && existingDir(posix)) roots.push(posix);
-      }
-    } catch { /* no posix venv layout */ }
-  }
-  return [...new Set(roots.map((r) => join(r)))];
-}
-
-function pyTopLevelMap(sitePackagesRoot) {
-  const map = new Map();
-  let entries = [];
-  try { entries = readdirSync(sitePackagesRoot); } catch { return map; }
-  for (const e of entries) {
-    if (!/\.dist-info$/i.test(e)) continue;
-    const dist = e.replace(/-\d[\w.!+-]*\.dist-info$/i, "");
-    const canonical = pep503(dist);
-    try {
-      const top = readFileSync(join(sitePackagesRoot, e, "top_level.txt"), "utf8");
-      for (const line of top.split(/\r?\n/).map((x) => x.trim()).filter(Boolean)) map.set(line, canonical);
-    } catch { /* metadata often omits top_level.txt */ }
-    try {
-      const meta = readFileSync(join(sitePackagesRoot, e, "METADATA"), "utf8");
-      const m = meta.match(/^Name:\s*(.+)$/mi);
-      if (m) map.set(dist, pep503(m[1]));
-    } catch { /* no metadata */ }
-  }
-  return map;
-}
-
-function pkgOfSitePackagesPath(file, sitePackagesRoot, topMap) {
-  const rel = normPath(relative(sitePackagesRoot, file));
-  if (!rel || rel.startsWith("..")) return "";
-  const first = rel.split("/")[0] || "";
-  if (!first || first === "__pycache__") return "";
-  if (/\.dist-info$|\.egg-info$/i.test(first)) return "";
-  const top = first.replace(/\.(py|so|pyd|dll|pth)$/i, "");
-  return topMap.get(top) || pep503(top);
-}
-
-function vendorModuleNames(installed) {
-  return [...new Set((installed || []).filter((p) => p.ecosystem === "Go" && p.name).map((p) => String(p.name)))].sort((a, b) => b.length - a.length);
-}
-
-function pkgOfVendorPath(file, vendorRoot, moduleNames) {
-  const rel = normPath(relative(vendorRoot, file));
-  if (!rel || rel.startsWith("..")) return "";
-  for (const name of moduleNames) if (rel === name || rel.startsWith(`${name}/`)) return name;
-  const parts = rel.split("/");
-  if (parts[0]?.includes(".") && parts.length >= 3) return parts.slice(0, 3).join("/");
-  return parts.slice(0, 2).join("/") || parts[0] || "";
-}
-
-function goCacheRoots() {
-  const roots = [];
-  if (process.env.GOMODCACHE) roots.push(...String(process.env.GOMODCACHE).split(delimiter));
-  for (const gp of String(process.env.GOPATH || join(homedir(), "go")).split(delimiter)) roots.push(join(gp, "pkg", "mod"));
-  return [...new Set(roots.filter(existingDir))];
-}
-
-function goModCacheEscape(modulePath) {
-  return String(modulePath || "").split("/").map((part) => part.replace(/[A-Z]/g, (c) => `!${c.toLowerCase()}`)).join("/");
-}
-
-function goModuleSourceRoots(installed) {
-  const roots = [];
-  const caches = goCacheRoots();
-  const goPkgs = (installed || []).filter((p) => p.ecosystem === "Go" && p.name && p.version);
-  for (const p of goPkgs) {
-    const mod = goModCacheEscape(p.name);
-    const ver = String(p.version).startsWith("v") ? String(p.version) : `v${p.version}`;
-    for (const cache of caches) {
-      const dir = join(cache, `${mod}@${ver}`);
-      if (existingDir(dir)) roots.push({ kind: "Go", root: dir, packages: 1, pathToPkg: () => p.name });
-    }
-  }
-  return roots;
-}
-
-export function buildContentRoots(repoPath, installed) {
-  const roots = [];
-  const nmDir = join(repoPath, "node_modules");
-  const jsPkgDirs = existingDir(nmDir) ? listPkgDirs(nmDir) : [];
-  if (jsPkgDirs.length) roots.push({ kind: "npm", root: nmDir, packages: jsPkgDirs.length, pathToPkg: pkgOfNodeModulesPath });
-
-  for (const sp of sitePackageRoots(repoPath)) {
-    const topMap = pyTopLevelMap(sp);
-    let packages = 0;
-    try { packages = readdirSync(sp).filter((e) => !e.startsWith(".") && !/\.dist-info$|\.egg-info$|__pycache__/i.test(e)).length; } catch { /* unreadable */ }
-    roots.push({ kind: "PyPI", root: sp, packages, pathToPkg: (file) => pkgOfSitePackagesPath(file, sp, topMap) });
-  }
-
-  const vendorRoot = join(repoPath, "vendor");
-  if (existingDir(vendorRoot)) {
-    const modules = vendorModuleNames(installed);
-    roots.push({ kind: "Go", root: vendorRoot, packages: modules.length || 1, pathToPkg: (file) => pkgOfVendorPath(file, vendorRoot, modules) });
-  }
-  roots.push(...goModuleSourceRoots(installed));
-  return roots;
-}
-
-export function listPkgDirs(nmDir) {
-  const out = [];
-  let entries;
-  try { entries = readdirSync(nmDir); } catch { return out; }
-  for (const e of entries) {
-    if (e.startsWith(".")) continue;
-    if (e.startsWith("@")) {
-      let scoped; try { scoped = readdirSync(join(nmDir, e)); } catch { continue; }
-      for (const s of scoped) out.push({ pkg: `${e}/${s}`, dir: join(nmDir, e, s) });
-    } else out.push({ pkg: e, dir: join(nmDir, e) });
-  }
-  return out;
-}
+// Content roots + path-to-package mapping for the malware scanner (split out of
+// malware-heuristics.js): npm node_modules, Python site-packages, Go vendor/ and module cache.
+import { readFileSync, readdirSync, existsSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { delimiter, join, relative } from "node:path";
+import { normPath } from "./malware-heuristics.exclusions.js";
+
+const pep503 = (name) => String(name || "").toLowerCase().replace(/[-_.]+/g, "-");
+
+// node_modules/@scope/name/... → @scope/name ; node_modules/name/... → name
+export function pkgOfNodeModulesPath(p) {
+  const s = String(p).replace(/\\/g, "/");
+  const i = s.lastIndexOf("node_modules/");
+  if (i < 0) return "";
+  const rest = s.slice(i + "node_modules/".length).split("/");
+  return rest[0]?.startsWith("@") ? `${rest[0]}/${rest[1] || ""}` : rest[0] || "";
+}
+
+function existingDir(p) {
+  try { return p && existsSync(p) && statSync(p).isDirectory(); } catch { return false; }
+}
+
+function sitePackageRoots(repoPath) {
+  const roots = [];
+  for (const venv of [".venv", "venv", "env"]) {
+    const win = join(repoPath, venv, "Lib", "site-packages");
+    if (existingDir(win)) roots.push(win);
+    try {
+      for (const d of readdirSync(join(repoPath, venv, "lib"))) {
+        const posix = join(repoPath, venv, "lib", String(d), "site-packages");
+        if (/^python/i.test(String(d)) && existingDir(posix)) roots.push(posix);
+      }
+    } catch { /* no posix venv layout */ }
+  }
+  return [...new Set(roots.map((r) => join(r)))];
+}
+
+function pyTopLevelMap(sitePackagesRoot) {
+  const map = new Map();
+  let entries = [];
+  try { entries = readdirSync(sitePackagesRoot); } catch { return map; }
+  for (const e of entries) {
+    if (!/\.dist-info$/i.test(e)) continue;
+    const dist = e.replace(/-\d[\w.!+-]*\.dist-info$/i, "");
+    const canonical = pep503(dist);
+    try {
+      const top = readFileSync(join(sitePackagesRoot, e, "top_level.txt"), "utf8");
+      for (const line of top.split(/\r?\n/).map((x) => x.trim()).filter(Boolean)) map.set(line, canonical);
+    } catch { /* metadata often omits top_level.txt */ }
+    try {
+      const meta = readFileSync(join(sitePackagesRoot, e, "METADATA"), "utf8");
+      const m = meta.match(/^Name:\s*(.+)$/mi);
+      if (m) map.set(dist, pep503(m[1]));
+    } catch { /* no metadata */ }
+  }
+  return map;
+}
+
+function pkgOfSitePackagesPath(file, sitePackagesRoot, topMap) {
+  const rel = normPath(relative(sitePackagesRoot, file));
+  if (!rel || rel.startsWith("..")) return "";
+  const first = rel.split("/")[0] || "";
+  if (!first || first === "__pycache__") return "";
+  if (/\.dist-info$|\.egg-info$/i.test(first)) return "";
+  const top = first.replace(/\.(py|so|pyd|dll|pth)$/i, "");
+  return topMap.get(top) || pep503(top);
+}
+
+function vendorModuleNames(installed) {
+  return [...new Set((installed || []).filter((p) => p.ecosystem === "Go" && p.name).map((p) => String(p.name)))].sort((a, b) => b.length - a.length);
+}
+
+function pkgOfVendorPath(file, vendorRoot, moduleNames) {
+  const rel = normPath(relative(vendorRoot, file));
+  if (!rel || rel.startsWith("..")) return "";
+  for (const name of moduleNames) if (rel === name || rel.startsWith(`${name}/`)) return name;
+  const parts = rel.split("/");
+  if (parts[0]?.includes(".") && parts.length >= 3) return parts.slice(0, 3).join("/");
+  return parts.slice(0, 2).join("/") || parts[0] || "";
+}
+
+function goCacheRoots() {
+  const roots = [];
+  if (process.env.GOMODCACHE) roots.push(...String(process.env.GOMODCACHE).split(delimiter));
+  for (const gp of String(process.env.GOPATH || join(homedir(), "go")).split(delimiter)) roots.push(join(gp, "pkg", "mod"));
+  return [...new Set(roots.filter(existingDir))];
+}
+
+function goModCacheEscape(modulePath) {
+  return String(modulePath || "").split("/").map((part) => part.replace(/[A-Z]/g, (c) => `!${c.toLowerCase()}`)).join("/");
+}
+
+function goModuleSourceRoots(installed) {
+  const roots = [];
+  const caches = goCacheRoots();
+  const goPkgs = (installed || []).filter((p) => p.ecosystem === "Go" && p.name && p.version);
+  for (const p of goPkgs) {
+    const mod = goModCacheEscape(p.name);
+    const ver = String(p.version).startsWith("v") ? String(p.version) : `v${p.version}`;
+    for (const cache of caches) {
+      const dir = join(cache, `${mod}@${ver}`);
+      if (existingDir(dir)) roots.push({ kind: "Go", root: dir, packages: 1, pathToPkg: () => p.name });
+    }
+  }
+  return roots;
+}
+
+export function buildContentRoots(repoPath, installed) {
+  const roots = [];
+  const nmDir = join(repoPath, "node_modules");
+  const jsPkgDirs = existingDir(nmDir) ? listPkgDirs(nmDir) : [];
+  if (jsPkgDirs.length) roots.push({ kind: "npm", root: nmDir, packages: jsPkgDirs.length, pathToPkg: pkgOfNodeModulesPath });
+
+  for (const sp of sitePackageRoots(repoPath)) {
+    const topMap = pyTopLevelMap(sp);
+    let packages = 0;
+    try { packages = readdirSync(sp).filter((e) => !e.startsWith(".") && !/\.dist-info$|\.egg-info$|__pycache__/i.test(e)).length; } catch { /* unreadable */ }
+    roots.push({ kind: "PyPI", root: sp, packages, pathToPkg: (file) => pkgOfSitePackagesPath(file, sp, topMap) });
+  }
+
+  const vendorRoot = join(repoPath, "vendor");
+  if (existingDir(vendorRoot)) {
+    const modules = vendorModuleNames(installed);
+    roots.push({ kind: "Go", root: vendorRoot, packages: modules.length || 1, pathToPkg: (file) => pkgOfVendorPath(file, vendorRoot, modules) });
+  }
+  roots.push(...goModuleSourceRoots(installed));
+  return roots;
+}
+
+export function listPkgDirs(nmDir) {
+  const out = [];
+  let entries;
+  try { entries = readdirSync(nmDir); } catch { return out; }
+  for (const e of entries) {
+    if (e.startsWith(".")) continue;
+    if (e.startsWith("@")) {
+      let scoped; try { scoped = readdirSync(join(nmDir, e)); } catch { continue; }
+      for (const s of scoped) out.push({ pkg: `${e}/${s}`, dir: join(nmDir, e, s) });
+    } else out.push({ pkg: e, dir: join(nmDir, e) });
+  }
+  return out;
+}