weavatrix 0.1.0

package/src/security/malware-file-heuristics.js

@@ -0,0 +1,121 @@
+import { readFileSync, readdirSync, existsSync, statSync, openSync, readSync, closeSync } from "node:fs";
+import { join, relative } from "node:path";
+import { MALWARE_ALLOWLIST, classifyPythonPth } from "./registry-sig.js";
+
+const normPath = (p) => String(p || "").replace(/\\/g, "/").replace(/\/+$/, "");
+const existingDir = (p) => {
+  try { return p && existsSync(p) && statSync(p).isDirectory(); } catch { return false; }
+};
+
+const PY_PTH_RE = /\.pth$/i;
+const BINARY_CANDIDATE_RE = /\.(exe|dll|dylib|so|node|bin)$/i;
+const BINARY_SUSPICIOUS_NAME_RE = /(^|[\\/])(postinstall|install|setup|update|loader|payload|helper|agent|service|runner)(\.[^\\/]+)?$/i;
+const NATIVE_SCRIPT_RE = /\b(node-gyp|node-pre-gyp|prebuild|node-gyp-build|cmake-js|cmake|make|napi|neon|cargo|go\s+build)\b/i;
+const NATIVE_DEP_RE = /^(node-addon-api|bindings|nan|prebuild-install|node-gyp|node-gyp-build|node-pre-gyp|@mapbox\/node-pre-gyp|cmake-js)$/i;
+const KNOWN_BINARY_PKG_RE = /^(?:@esbuild\/|@swc\/|@rollup\/rollup-|@img\/|@parcel\/watcher|esbuild$|sharp$|electron$|playwright$|@playwright\/|puppeteer$|cypress$|sass-embedded$|lightningcss$|tree-sitter$|tree-sitter-wasms$|better-sqlite3$|sqlite3$|bcrypt$|fsevents$|re2$|canvas$|workerd$)/i;
+const BUNDLED_BINARY_RULE = {
+  key: "bundled-binary",
+  severity: "medium",
+  nearZeroFp: false,
+  noisy: true,
+  what: "bundled executable/native binary without native-build package metadata",
+};
+
+function readJsonFile(file) {
+  try { return JSON.parse(readFileSync(file, "utf8")); } catch { return null; }
+}
+
+function hasNativeBuildHint(dir, pkgJson) {
+  const pj = pkgJson || {};
+  if (pj.gypfile || pj.binary || pj.os || pj.cpu) return true;
+  if (existingDir(join(dir, "prebuilds")) || existsSync(join(dir, "binding.gyp"))) return true;
+  const scriptText = Object.values(pj.scripts || {}).join("\n");
+  if (NATIVE_SCRIPT_RE.test(scriptText)) return true;
+  const deps = { ...(pj.dependencies || {}), ...(pj.optionalDependencies || {}), ...(pj.devDependencies || {}) };
+  return Object.keys(deps).some((name) => NATIVE_DEP_RE.test(name));
+}
+
+function binaryMagic(file) {
+  let fd = null;
+  try {
+    fd = openSync(file, "r");
+    const b = Buffer.alloc(8);
+    const n = readSync(fd, b, 0, b.length, 0);
+    if (n >= 2 && b[0] === 0x4d && b[1] === 0x5a) return "PE";
+    if (n >= 4 && b[0] === 0x7f && b[1] === 0x45 && b[2] === 0x4c && b[3] === 0x46) return "ELF";
+    if (n >= 4) {
+      const hex = b.subarray(0, 4).toString("hex");
+      if (["feedface", "feedfacf", "cefaedfe", "cffaedfe", "cafebabe", "cafebabf"].includes(hex)) return "Mach-O";
+    }
+  } catch { /* not readable */ }
+  finally { if (fd != null) { try { closeSync(fd); } catch { /* ignore */ } } }
+  return "";
+}
+
+function shouldSkipMetaPath(rel) {
+  const p = normPath(rel).toLowerCase();
+  return /(^|\/)(node_modules|\.git|docs?|documentation|test|tests|__tests__|fixtures?|examples?|coverage|dist-types)(\/|$)/.test(p) || /\.(map|md|mdx|markdown|rst|txt|d\.ts)$/i.test(p);
+}
+
+function binaryArtifactSweep(pkgDirs, capFiles = 12000) {
+  const hits = [];
+  let seen = 0;
+  for (const { pkg, dir } of pkgDirs) {
+    if (seen >= capFiles) break;
+    if (MALWARE_ALLOWLIST.has(pkg) || KNOWN_BINARY_PKG_RE.test(pkg)) continue;
+    const pj = readJsonFile(join(dir, "package.json")) || {};
+    if (hasNativeBuildHint(dir, pj)) continue;
+    const stack = [dir];
+    while (stack.length && seen < capFiles) {
+      const cur = stack.pop();
+      let entries = [];
+      try { entries = readdirSync(cur, { withFileTypes: true }); } catch { continue; }
+      for (const e of entries) {
+        const full = join(cur, e.name);
+        const rel = relative(dir, full);
+        if (shouldSkipMetaPath(rel)) continue;
+        if (e.isDirectory()) { stack.push(full); continue; }
+        if (!e.isFile()) continue;
+        seen++;
+        if (!BINARY_CANDIDATE_RE.test(e.name) && !BINARY_SUSPICIOUS_NAME_RE.test(full)) continue;
+        let st; try { st = statSync(full); } catch { continue; }
+        if (!st.size || st.size > 80_000_000) continue;
+        const kind = binaryMagic(full);
+        if (!kind) continue;
+        hits.push({
+          pkg,
+          file: full,
+          line: 0,
+          text: `${kind} binary ${normPath(rel)} in package with no native-build metadata`,
+          rule: BUNDLED_BINARY_RULE,
+        });
+        break;
+      }
+    }
+  }
+  return hits;
+}
+
+function pythonPthSweep(contentRoots) {
+  const hits = [];
+  for (const root of contentRoots) {
+    if (root.kind !== "PyPI") continue;
+    let entries = [];
+    try { entries = readdirSync(root.root, { withFileTypes: true }); } catch { continue; }
+    for (const e of entries) {
+      if (!e.isFile() || !PY_PTH_RE.test(e.name)) continue;
+      const file = join(root.root, e.name);
+      let text = "";
+      try { text = readFileSync(file, "utf8"); } catch { continue; }
+      const pkg = root.pathToPkg(file) || e.name.replace(PY_PTH_RE, "");
+      for (const sig of classifyPythonPth(text)) {
+        hits.push({ pkg, file, line: sig.line || 0, text: sig.snippet || "", rule: sig });
+      }
+    }
+  }
+  return hits;
+}
+
+export function fileHeuristicSweep(contentRoots, pkgDirs) {
+  return [...pythonPthSweep(contentRoots), ...binaryArtifactSweep(pkgDirs)];
+}

package/src/security/malware-heuristics.exclusions.js

@@ -0,0 +1,134 @@
+// Allowlist/exclusion parsing and URL/doc-noise filters for the malware scanner (split out of
+// malware-heuristics.js; see that file for the scanner overview).
+import { NOISY_URL_KEYS, isDocFile, isBenignUrlContext } from "./registry-sig.js";
+
+export const normPath = (p) => String(p || "").replace(/\\/g, "/").replace(/\/+$/, "");
+const URL_RULE_KEYS = new Set(["exfil-url", "exfil-ip", "cloud-metadata-url", "network-url", "hardcoded-url"]);
+const URL_RE = /https?:\/\/[^\s'"`)\\<>]+/gi;
+const PACKAGE_JSON_SCRIPT_RE = /["']?(preinstall|install|postinstall|prepare|prepack|postpack|prepublish|prepublishonly)["']?\s*:/i;
+const PACKAGE_JSON_METADATA_URL_RE = /["']?(bugs|homepage|repository|funding|author|contributors|maintainers|publishConfig|license)["']?\s*:|["']?url["']?\s*:/i;
+const NETWORK_CALL_RE = /\b(fetch|axios\.|XMLHttpRequest|sendBeacon|https?\.request|request\(|curl\b|wget\b|iwr\b|invoke-webrequest)\b/i;
+const LIFECYCLE_SCRIPT_HOOKS = ["preinstall", "install", "postinstall", "prepare"];
+
+function cleanUrlToken(value) {
+  return String(value || "").trim().replace(/[.,;:!?]+$/g, "").replace(/[)\]}]+$/g, "");
+}
+
+function splitAllowlistText(value) {
+  if (Array.isArray(value)) return value.flatMap(splitAllowlistText);
+  return String(value || "")
+    .split(/[\r\n,]+/)
+    .map((line) => line.replace(/\s+#.*$/, "").trim())
+    .filter(Boolean);
+}
+
+function normalizeHost(value) {
+  let s = String(value || "").trim().toLowerCase();
+  if (!s) return "";
+  try {
+    if (/^https?:\/\//i.test(s)) s = new URL(s).host;
+  } catch { /* keep raw */ }
+  return s.replace(/^\*\./, "").replace(/^\./, "").replace(/:\d+$/, "");
+}
+
+function normalizeUrl(value) {
+  const raw = cleanUrlToken(value);
+  if (!raw) return "";
+  try {
+    const u = new URL(raw);
+    const path = u.pathname.replace(/\/+$/, "");
+    return `${u.protocol.toLowerCase()}//${u.host.toLowerCase()}${path}${u.search || ""}`;
+  } catch {
+    return raw.toLowerCase().replace(/\/+$/, "");
+  }
+}
+
+function extractUrls(text) {
+  return [...String(text || "").matchAll(URL_RE)].map((m) => cleanUrlToken(m[0])).filter(Boolean);
+}
+
+function urlMatchesAllow(allowUrl, candidate) {
+  const a = normalizeUrl(allowUrl);
+  const c = normalizeUrl(candidate);
+  if (!a || !c) return false;
+  return c === a || c.startsWith(`${a}/`) || a.startsWith(`${c}/`);
+}
+
+function hostMatchesAllow(allowHost, candidate) {
+  const a = normalizeHost(allowHost);
+  const c = normalizeHost(candidate);
+  return !!(a && c && (c === a || c.endsWith(`.${a}`)));
+}
+
+export function parseMalwareExclusions(input = {}) {
+  const out = { urls: [], hosts: [], packages: [], rules: [] };
+  const add = (raw) => {
+    const s = cleanUrlToken(raw);
+    if (!s) return;
+    const lower = s.toLowerCase();
+    if (lower.startsWith("pkg:")) { out.packages.push(s.slice(4).trim()); return; }
+    if (lower.startsWith("package:")) { out.packages.push(s.slice(8).trim()); return; }
+    if (lower.startsWith("rule:")) { out.rules.push(s.slice(5).trim()); return; }
+    if (lower.startsWith("host:")) { out.hosts.push(normalizeHost(s.slice(5))); return; }
+    if (lower.startsWith("domain:")) { out.hosts.push(normalizeHost(s.slice(7))); return; }
+    if (/^https?:\/\//i.test(s)) { out.urls.push(normalizeUrl(s)); out.hosts.push(normalizeHost(s)); return; }
+    if (!s.includes("/") && s.includes(".")) { out.hosts.push(normalizeHost(s)); return; }
+    out.packages.push(s);
+  };
+  if (typeof input === "string" || Array.isArray(input)) {
+    for (const line of splitAllowlistText(input)) add(line);
+  } else if (input && typeof input === "object") {
+    for (const line of splitAllowlistText(input.urls || input.url || "")) add(line);
+    for (const line of splitAllowlistText(input.domains || input.domain || "")) add(`host:${line}`);
+    for (const line of splitAllowlistText(input.packages || input.package || "")) add(/^pkg(age)?:/i.test(line) ? line : `pkg:${line}`);
+    for (const line of splitAllowlistText(input.rules || input.rule || "")) add(`rule:${line}`);
+  }
+  return {
+    urls: [...new Set(out.urls.filter(Boolean))],
+    hosts: [...new Set(out.hosts.filter(Boolean))],
+    packages: [...new Set(out.packages.map((p) => p.trim()).filter(Boolean))],
+    rules: [...new Set(out.rules.map((r) => r.trim()).filter(Boolean))],
+  };
+}
+
+export function isManifestUrlNoise(file, signal) {
+  if (!URL_RULE_KEYS.has(signal?.key)) return false;
+  const f = normPath(file).toLowerCase();
+  const text = `${signal?.snippet || ""}`.trim();
+  if (/(^|\/)package\.json$/.test(f)) {
+    if (PACKAGE_JSON_SCRIPT_RE.test(text)) return false;
+    return PACKAGE_JSON_METADATA_URL_RE.test(text) || !NETWORK_CALL_RE.test(text);
+  }
+  return /(^|\/)(pkg-info|metadata)$/.test(f);
+}
+
+export function lifecycleScriptSnippet(scripts = {}) {
+  for (const hook of LIFECYCLE_SCRIPT_HOOKS) {
+    const s = String(scripts?.[hook] || "").trim();
+    if (s) return `${hook}: ${s}`.slice(0, 200);
+  }
+  return "";
+}
+
+// weak URL rules only: URL evidence in a license/prose file or in comment/doc-link context is
+// documentation, not behavior (LICENSE:5 "http://www.apache.org/licenses/" was the hot FP).
+// Strong rules (miner/shell/exfil-url) are untouched and still scan those same files.
+export function isDocUrlNoise(file, signal) {
+  if (!NOISY_URL_KEYS.has(signal?.key)) return false;
+  return isDocFile(file) || isBenignUrlContext(signal?.snippet || "");
+}
+
+export function isMalwareSignalExcluded(pkg, signal, exclusions = {}) {
+  const ex = exclusions.urls || exclusions.hosts || exclusions.packages || exclusions.rules ? exclusions : parseMalwareExclusions(exclusions);
+  if (signal?.key && ex.rules.includes(signal.key)) return true;
+  if (ex.packages.some((p) => p.toLowerCase() === String(pkg || "").toLowerCase()) && signal?.noisy) return true;
+  if (!URL_RULE_KEYS.has(signal?.key)) return false;
+  const text = `${signal?.snippet || ""}\n${signal?.file || ""}`;
+  const urls = extractUrls(text);
+  for (const url of urls) {
+    if (ex.urls.some((allowed) => urlMatchesAllow(allowed, url))) return true;
+    if (ex.hosts.some((allowed) => hostMatchesAllow(allowed, url))) return true;
+  }
+  if (!urls.length && ex.hosts.some((host) => host && text.toLowerCase().includes(host))) return true;
+  return false;
+}

package/src/security/malware-heuristics.js

@@ -0,0 +1,15 @@
+// Heuristic malware scanner over INSTALLED dependencies (defensive): install-script beacons, crypto-
+// miner signatures, exfiltration endpoints, obfuscation markers, non-registry install sources.
+// Phase A (always, cheap): every installed package's package.json scripts + lockfile `resolved` origin.
+// Phase B (content): ripgrep sweep of node_modules when rg is available (full coverage), else a bounded
+// Node fallback over each package's entry files. Multi-signal scoring per package: high/critical needs
+// a near-zero-FP rule OR >=2 independent rule keys; the allowlist downgrades ONLY noisy rules.
+// This catches known PATTERNS — it is not a sandbox or a reputation service (honest limit, in the UI).
+// Split into sibling modules (this file stays the import path):
+//   malware-heuristics.exclusions.js - allowlist parsing + URL/doc noise filters
+//   malware-heuristics.roots.js      - content roots + path-to-package mapping
+//   malware-heuristics.sweep.js      - ripgrep / Node content sweeps
+//   malware-heuristics.scan.js       - scanMalware orchestration
+export { parseMalwareExclusions, isMalwareSignalExcluded } from "./malware-heuristics.exclusions.js";
+export { pkgOfNodeModulesPath } from "./malware-heuristics.roots.js";
+export { scanMalware } from "./malware-heuristics.scan.js";

package/src/security/malware-heuristics.roots.js

@@ -0,0 +1,142 @@
+// Content roots + path-to-package mapping for the malware scanner (split out of
+// malware-heuristics.js): npm node_modules, Python site-packages, Go vendor/ and module cache.
+import { readFileSync, readdirSync, existsSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { delimiter, join, relative } from "node:path";
+import { normPath } from "./malware-heuristics.exclusions.js";
+
+const pep503 = (name) => String(name || "").toLowerCase().replace(/[-_.]+/g, "-");
+
+// node_modules/@scope/name/... → @scope/name ; node_modules/name/... → name
+export function pkgOfNodeModulesPath(p) {
+  const s = String(p).replace(/\\/g, "/");
+  const i = s.lastIndexOf("node_modules/");
+  if (i < 0) return "";
+  const rest = s.slice(i + "node_modules/".length).split("/");
+  return rest[0]?.startsWith("@") ? `${rest[0]}/${rest[1] || ""}` : rest[0] || "";
+}
+
+function existingDir(p) {
+  try { return p && existsSync(p) && statSync(p).isDirectory(); } catch { return false; }
+}
+
+function sitePackageRoots(repoPath) {
+  const roots = [];
+  for (const venv of [".venv", "venv", "env"]) {
+    const win = join(repoPath, venv, "Lib", "site-packages");
+    if (existingDir(win)) roots.push(win);
+    try {
+      for (const d of readdirSync(join(repoPath, venv, "lib"))) {
+        const posix = join(repoPath, venv, "lib", String(d), "site-packages");
+        if (/^python/i.test(String(d)) && existingDir(posix)) roots.push(posix);
+      }
+    } catch { /* no posix venv layout */ }
+  }
+  return [...new Set(roots.map((r) => join(r)))];
+}
+
+function pyTopLevelMap(sitePackagesRoot) {
+  const map = new Map();
+  let entries = [];
+  try { entries = readdirSync(sitePackagesRoot); } catch { return map; }
+  for (const e of entries) {
+    if (!/\.dist-info$/i.test(e)) continue;
+    const dist = e.replace(/-\d[\w.!+-]*\.dist-info$/i, "");
+    const canonical = pep503(dist);
+    try {
+      const top = readFileSync(join(sitePackagesRoot, e, "top_level.txt"), "utf8");
+      for (const line of top.split(/\r?\n/).map((x) => x.trim()).filter(Boolean)) map.set(line, canonical);
+    } catch { /* metadata often omits top_level.txt */ }
+    try {
+      const meta = readFileSync(join(sitePackagesRoot, e, "METADATA"), "utf8");
+      const m = meta.match(/^Name:\s*(.+)$/mi);
+      if (m) map.set(dist, pep503(m[1]));
+    } catch { /* no metadata */ }
+  }
+  return map;
+}
+
+function pkgOfSitePackagesPath(file, sitePackagesRoot, topMap) {
+  const rel = normPath(relative(sitePackagesRoot, file));
+  if (!rel || rel.startsWith("..")) return "";
+  const first = rel.split("/")[0] || "";
+  if (!first || first === "__pycache__") return "";
+  if (/\.dist-info$|\.egg-info$/i.test(first)) return "";
+  const top = first.replace(/\.(py|so|pyd|dll|pth)$/i, "");
+  return topMap.get(top) || pep503(top);
+}
+
+function vendorModuleNames(installed) {
+  return [...new Set((installed || []).filter((p) => p.ecosystem === "Go" && p.name).map((p) => String(p.name)))].sort((a, b) => b.length - a.length);
+}
+
+function pkgOfVendorPath(file, vendorRoot, moduleNames) {
+  const rel = normPath(relative(vendorRoot, file));
+  if (!rel || rel.startsWith("..")) return "";
+  for (const name of moduleNames) if (rel === name || rel.startsWith(`${name}/`)) return name;
+  const parts = rel.split("/");
+  if (parts[0]?.includes(".") && parts.length >= 3) return parts.slice(0, 3).join("/");
+  return parts.slice(0, 2).join("/") || parts[0] || "";
+}
+
+function goCacheRoots() {
+  const roots = [];
+  if (process.env.GOMODCACHE) roots.push(...String(process.env.GOMODCACHE).split(delimiter));
+  for (const gp of String(process.env.GOPATH || join(homedir(), "go")).split(delimiter)) roots.push(join(gp, "pkg", "mod"));
+  return [...new Set(roots.filter(existingDir))];
+}
+
+function goModCacheEscape(modulePath) {
+  return String(modulePath || "").split("/").map((part) => part.replace(/[A-Z]/g, (c) => `!${c.toLowerCase()}`)).join("/");
+}
+
+function goModuleSourceRoots(installed) {
+  const roots = [];
+  const caches = goCacheRoots();
+  const goPkgs = (installed || []).filter((p) => p.ecosystem === "Go" && p.name && p.version);
+  for (const p of goPkgs) {
+    const mod = goModCacheEscape(p.name);
+    const ver = String(p.version).startsWith("v") ? String(p.version) : `v${p.version}`;
+    for (const cache of caches) {
+      const dir = join(cache, `${mod}@${ver}`);
+      if (existingDir(dir)) roots.push({ kind: "Go", root: dir, packages: 1, pathToPkg: () => p.name });
+    }
+  }
+  return roots;
+}
+
+export function buildContentRoots(repoPath, installed) {
+  const roots = [];
+  const nmDir = join(repoPath, "node_modules");
+  const jsPkgDirs = existingDir(nmDir) ? listPkgDirs(nmDir) : [];
+  if (jsPkgDirs.length) roots.push({ kind: "npm", root: nmDir, packages: jsPkgDirs.length, pathToPkg: pkgOfNodeModulesPath });
+
+  for (const sp of sitePackageRoots(repoPath)) {
+    const topMap = pyTopLevelMap(sp);
+    let packages = 0;
+    try { packages = readdirSync(sp).filter((e) => !e.startsWith(".") && !/\.dist-info$|\.egg-info$|__pycache__/i.test(e)).length; } catch { /* unreadable */ }
+    roots.push({ kind: "PyPI", root: sp, packages, pathToPkg: (file) => pkgOfSitePackagesPath(file, sp, topMap) });
+  }
+
+  const vendorRoot = join(repoPath, "vendor");
+  if (existingDir(vendorRoot)) {
+    const modules = vendorModuleNames(installed);
+    roots.push({ kind: "Go", root: vendorRoot, packages: modules.length || 1, pathToPkg: (file) => pkgOfVendorPath(file, vendorRoot, modules) });
+  }
+  roots.push(...goModuleSourceRoots(installed));
+  return roots;
+}
+
+export function listPkgDirs(nmDir) {
+  const out = [];
+  let entries;
+  try { entries = readdirSync(nmDir); } catch { return out; }
+  for (const e of entries) {
+    if (e.startsWith(".")) continue;
+    if (e.startsWith("@")) {
+      let scoped; try { scoped = readdirSync(join(nmDir, e)); } catch { continue; }
+      for (const s of scoped) out.push({ pkg: `${e}/${s}`, dir: join(nmDir, e, s) });
+    } else out.push({ pkg: e, dir: join(nmDir, e) });
+  }
+  return out;
+}

package/src/security/malware-heuristics.scan.js

@@ -0,0 +1,87 @@
+// scanMalware orchestration (split out of malware-heuristics.js): phase A install scripts +
+// lockfile origins, phase B content sweep, path-aware file heuristics, then scoring.
+import { readFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { resolveRg } from "../scan/search.js";
+import { classifyInstallScript, classifyResolvedUrl, isCloudSdkMetadataUse } from "./registry-sig.js";
+import { fileHeuristicSweep } from "./malware-file-heuristics.js";
+import { buildMalwareFindings } from "./malware-scoring.js";
+import { parseMalwareExclusions, isManifestUrlNoise, isDocUrlNoise, isMalwareSignalExcluded, lifecycleScriptSnippet } from "./malware-heuristics.exclusions.js";
+import { buildContentRoots, listPkgDirs } from "./malware-heuristics.roots.js";
+import { rgSweep, nodeSweep } from "./malware-heuristics.sweep.js";
+
+// → { findings, scanMode } ; importedPkgs = Set of packages the repo's own code imports (evidence note).
+export async function scanMalware(repoPath, { installed = [], importedPkgs = new Set(), rgPath = "", forceNode = false, timeoutMs = 60000, malwareExclusions = {} } = {}) {
+  const nmDir = join(repoPath, "node_modules");
+  const contentRoots = buildContentRoots(repoPath, installed);
+  const byPkg = new Map(); // pkg -> [{rule signal, file, line, snippet}]
+  const exclusions = parseMalwareExclusions(malwareExclusions);
+  let excludedSignals = 0;
+  const add = (pkg, sig, file = "", line = 0, snippet = "") => {
+    if (!pkg) return;
+    const signal = { ...sig, file, line, snippet: snippet || sig.snippet || "" };
+    if (isManifestUrlNoise(file, signal) || isDocUrlNoise(file, signal) || isCloudSdkMetadataUse(pkg, signal.key) || isMalwareSignalExcluded(pkg, signal, exclusions)) {
+      excludedSignals++;
+      return;
+    }
+    (byPkg.get(pkg) || byPkg.set(pkg, []).get(pkg)).push(signal);
+  };
+
+  // ---- phase A: install scripts (from node_modules package.jsons) + lockfile resolved origins ----
+  const pkgDirs = existsSync(nmDir) ? listPkgDirs(nmDir) : [];
+  const lockScriptMeta = new Map(
+    (installed || [])
+      .filter((p) => p.ecosystem === "npm" && p.source === "package-lock" && p.hasInstallScript !== undefined)
+      .map((p) => [`${p.name}@${p.version}`, !!p.hasInstallScript])
+  );
+  for (const { pkg, dir } of pkgDirs) {
+    try {
+      const pj = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
+      const scriptSnippet = lifecycleScriptSnippet(pj.scripts);
+      if (scriptSnippet && lockScriptMeta.get(`${pkg}@${pj.version || ""}`) === false) {
+        add(pkg, {
+          key: "install-script-drift",
+          severity: "high",
+          nearZeroFp: false,
+          what: "installed package has lifecycle scripts absent from package-lock metadata",
+          snippet: scriptSnippet,
+        }, join(dir, "package.json"));
+      }
+      for (const sig of classifyInstallScript(pj.scripts)) add(pkg, sig, join(dir, "package.json"));
+    } catch { /* not a package */ }
+  }
+  for (const p of installed) {
+    const sig = p.resolved ? classifyResolvedUrl(p.resolved) : null;
+    if (sig) add(p.name, sig, "package-lock.json");
+  }
+
+  // ---- phase B: content sweep ----
+  let scanMode = "none";
+  if (contentRoots.length) {
+    const rg = forceNode ? null : await resolveRg("auto", rgPath);
+    let swept = false;
+    if (rg) {
+      const { hits, errored, total } = await rgSweep(rg, contentRoots, timeoutMs);
+      if (errored < total) {
+        // honest label: full when every rule ran, partial when some rules failed (don't claim
+        // full coverage we didn't get); every-rule-failed falls through to the Node sweep below.
+        const kinds = [...new Set(contentRoots.map((r) => r.kind))].join("+");
+        scanMode = errored ? `ripgrep-partial (${total - errored}/${total} sweeps; ${kinds})` : `ripgrep-full (${kinds})`;
+        swept = true;
+        for (const h of hits) add(h.pkg, h.rule, h.file, h.line, h.text);
+      }
+    }
+    if (!swept) {
+      scanMode = rg ? "node-limited (ripgrep failed)" : "node-limited";
+      for (const h of nodeSweep(nmDir, pkgDirs)) add(h.pkg, h.rule, h.file, h.line, h.text);
+    }
+  } else {
+    scanMode = "skipped";
+  }
+
+  // ---- path-aware cheap checks: things that need file names or magic bytes, not just regex text.
+  // These run regardless of rg availability and stay bounded; content regex still does the broad sweep.
+  for (const h of fileHeuristicSweep(contentRoots, pkgDirs)) add(h.pkg, h.rule, h.file, h.line, h.text);
+
+  return buildMalwareFindings({ byPkg, importedPkgs, contentRoots, scanMode, excludedSignals });
+}

package/src/security/malware-heuristics.sweep.js

@@ -0,0 +1,122 @@
+// Content sweeps for the malware scanner (split out of malware-heuristics.js): a ripgrep sweep
+// over all content roots when rg is available, else a bounded Node fallback over entry files.
+import { readFileSync, readdirSync, existsSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { runCommand } from "../process.js";
+import { CONTENT_RULES, classifyContent } from "./registry-sig.js";
+import { normPath } from "./malware-heuristics.exclusions.js";
+
+const SKIP_GLOBS = [
+  "!**/*.map", "!**/*.md", "!**/*.mdx", "!**/*.markdown", "!**/*.mdown", "!**/*.mkd", "!**/*.rst", "!**/*.d.ts",
+  "!**/doc/**", "!**/docs/**", "!**/documentation/**",
+  "!**/test/**", "!**/tests/**", "!**/__tests__/**", "!**/fixtures/**", "!**/example/**", "!**/examples/**"
+];
+
+function globalRuleRegex(rule) {
+  const flags = rule.re.flags.includes("g") ? rule.re.flags : `${rule.re.flags}g`;
+  return new RegExp(rule.re.source, flags);
+}
+
+function matchRuleOffsets(rule, lineText, subText = "") {
+  const text = String(lineText || "");
+  if (text) {
+    const offsets = [];
+    const re = globalRuleRegex(rule);
+    let guard = 0;
+    let m;
+    while ((m = re.exec(text)) && guard++ < 24) {
+      offsets.push(m.index);
+      if (!m[0].length) re.lastIndex++;
+    }
+    if (!offsets.length && rule.key === "obfuscated-code") {
+      const at = subText ? text.indexOf(subText) : 0;
+      if (at >= 0) offsets.push(at);
+    }
+    return offsets;
+  }
+  if (subText && (rule.key === "obfuscated-code" || rule.re.test(subText))) return [0];
+  return [];
+}
+
+function rootOfFile(file, roots) {
+  const f = normPath(file).toLowerCase();
+  return roots.find((r) => {
+    const root = normPath(r.root).toLowerCase();
+    return f === root || f.startsWith(`${root}/`);
+  });
+}
+
+function chunks(list, size) {
+  const out = [];
+  for (let i = 0; i < list.length; i += size) out.push(list.slice(i, i + size));
+  return out;
+}
+
+export async function rgSweep(rg, contentRoots, timeoutMs) {
+  const hits = []; // {pkg, file, line, text, rule}
+  let errored = 0; // a failed/broken rule must not masquerade as "scanned, 0 hits"
+  let total = 0;
+  for (const rule of CONTENT_RULES) {
+    for (const group of chunks(contentRoots, 40)) {
+      total++;
+      const args = ["--json", "-i", "--no-ignore", "--hidden", "--follow", "--max-filesize", "2M", "--max-count", "20", ...SKIP_GLOBS.flatMap((g) => ["-g", g]), "-e", rule.pattern, "--", ...group.map((r) => r.root)];
+      let r;
+      try { r = await runCommand(rg, args, { timeoutMs }); } catch { errored++; continue; }
+      if (r.exitCode === 2 && !String(r.stdout || "").trim()) { errored++; continue; }
+      for (const line of String(r.stdout || "").split(/\r?\n/)) {
+        if (!line) continue;
+        let obj; try { obj = JSON.parse(line); } catch { continue; }
+        if (obj.type !== "match") continue;
+        const file = obj.data?.path?.text || "";
+        const root = rootOfFile(file, group);
+        const pkg = root?.pathToPkg(file) || "";
+        if (!pkg) continue;
+        const lineText = String(obj.data?.lines?.text || "");
+        const subText = String(obj.data?.submatches?.[0]?.match?.text || "");
+        for (const at of matchRuleOffsets(rule, lineText, subText)) {
+          const text = (lineText ? lineText.slice(Math.max(0, at - 60), at + 180) : subText).trim().slice(0, 240);
+          hits.push({ pkg, file, line: obj.data?.line_number || 0, text, rule });
+        }
+      }
+    }
+  }
+  return { hits, errored, total };
+}
+
+// no-rg fallback: each package's package.json main/bin entries + root JS files, bounded
+export function nodeSweep(nmDir, pkgDirs, capFiles = 3000) {
+  const hits = [];
+  let seenFiles = 0;
+  for (const { pkg, dir } of pkgDirs) {
+    if (seenFiles >= capFiles) break;
+    let pj = null;
+    try { pj = JSON.parse(readFileSync(join(dir, "package.json"), "utf8")); } catch { continue; }
+    const cands = new Set();
+    for (const f of [pj.main, pj.module, pj.browser]) if (typeof f === "string") cands.add(f);
+    if (pj.bin) for (const b of typeof pj.bin === "string" ? [pj.bin] : Object.values(pj.bin)) cands.add(b);
+    let rootJs = [];
+    try { rootJs = readdirSync(dir).filter((f) => /\.(c|m)?js$/.test(f)).slice(0, 6); } catch { /* gone */ }
+    for (const f of rootJs) cands.add(f);
+    if (!cands.size) cands.add("index.js");
+    for (const rel of cands) {
+      if (seenFiles >= capFiles) break;
+      const full = join(dir, String(rel));
+      try {
+        if (!existsSync(full) || statSync(full).size > 2_000_000) continue;
+        seenFiles++;
+        const text = readFileSync(full, "utf8");
+        for (const rule of classifyContent(text)) {
+          for (const at of matchRuleOffsets(rule, text)) {
+            // snippet keeps up to 60 chars of same-line PRE-context (like the rg path) so the
+            // comment/doc-context noise filter can see "// see" markers before the match
+            const lineStart = text.lastIndexOf("\n", at) + 1;
+            const nl = text.indexOf("\n", at);
+            const snippet = text.slice(Math.max(lineStart, at - 60), Math.min(nl < 0 ? text.length : nl, at + 200)).trim().slice(0, 240);
+            hits.push({ pkg, file: full, line: at >= 0 ? text.slice(0, at).split("\n").length : 0, text: snippet, rule });
+          }
+        }
+      } catch { /* unreadable */ }
+    }
+  }
+  return hits;
+}