weavatrix 0.3.13 → 1.0.0

package/src/security/malware-heuristics.roots.js

@@ -1,145 +0,0 @@
-// Content roots + path-to-package mapping for the malware scanner (split out of
-// malware-heuristics.js): npm node_modules, Python site-packages, Go vendor/ and module cache.
-import { readFileSync, readdirSync, existsSync, statSync } from "node:fs";
-import { homedir } from "node:os";
-import { delimiter, join, relative } from "node:path";
-import { normPath } from "./malware-heuristics.exclusions.js";
-
-const pep503 = (name) => String(name || "").toLowerCase().replace(/[-_.]+/g, "-");
-
-// node_modules/@scope/name/... → @scope/name ; node_modules/name/... → name
-export function pkgOfNodeModulesPath(p) {
-  const s = String(p).replace(/\\/g, "/");
-  const i = s.lastIndexOf("node_modules/");
-  if (i < 0) return "";
-  const rest = s.slice(i + "node_modules/".length).split("/");
-  return rest[0]?.startsWith("@") ? `${rest[0]}/${rest[1] || ""}` : rest[0] || "";
-}
-
-function existingDir(p) {
-  try { return p && existsSync(p) && statSync(p).isDirectory(); } catch { return false; }
-}
-
-function sitePackageRoots(repoPath) {
-  const roots = [];
-  for (const venv of [".venv", "venv", "env"]) {
-    const win = join(repoPath, venv, "Lib", "site-packages");
-    if (existingDir(win)) roots.push(win);
-    try {
-      for (const d of readdirSync(join(repoPath, venv, "lib"))) {
-        const posix = join(repoPath, venv, "lib", String(d), "site-packages");
-        if (/^python/i.test(String(d)) && existingDir(posix)) roots.push(posix);
-      }
-    } catch { /* no posix venv layout */ }
-  }
-  return [...new Set(roots.map((r) => join(r)))];
-}
-
-function pyTopLevelMap(sitePackagesRoot) {
-  const map = new Map();
-  let entries = [];
-  try { entries = readdirSync(sitePackagesRoot); } catch { return map; }
-  for (const e of entries) {
-    if (!/\.dist-info$/i.test(e)) continue;
-    const dist = e.replace(/-\d[\w.!+-]*\.dist-info$/i, "");
-    const canonical = pep503(dist);
-    try {
-      const top = readFileSync(join(sitePackagesRoot, e, "top_level.txt"), "utf8");
-      for (const line of top.split(/\r?\n/).map((x) => x.trim()).filter(Boolean)) map.set(line, canonical);
-    } catch { /* metadata often omits top_level.txt */ }
-    try {
-      const meta = readFileSync(join(sitePackagesRoot, e, "METADATA"), "utf8");
-      const m = meta.match(/^Name:\s*(.+)$/mi);
-      if (m) map.set(dist, pep503(m[1]));
-    } catch { /* no metadata */ }
-  }
-  return map;
-}
-
-function pkgOfSitePackagesPath(file, sitePackagesRoot, topMap) {
-  const rel = normPath(relative(sitePackagesRoot, file));
-  if (!rel || rel.startsWith("..")) return "";
-  const first = rel.split("/")[0] || "";
-  if (!first || first === "__pycache__") return "";
-  if (/\.dist-info$|\.egg-info$/i.test(first)) return "";
-  const top = first.replace(/\.(py|so|pyd|dll|pth)$/i, "");
-  return topMap.get(top) || pep503(top);
-}
-
-function vendorModuleNames(installed) {
-  return [...new Set((installed || []).filter((p) => p.ecosystem === "Go" && p.name).map((p) => String(p.name)))].sort((a, b) => b.length - a.length);
-}
-
-function pkgOfVendorPath(file, vendorRoot, moduleNames) {
-  const rel = normPath(relative(vendorRoot, file));
-  if (!rel || rel.startsWith("..")) return "";
-  for (const name of moduleNames) if (rel === name || rel.startsWith(`${name}/`)) return name;
-  const parts = rel.split("/");
-  if (parts[0]?.includes(".") && parts.length >= 3) return parts.slice(0, 3).join("/");
-  return parts.slice(0, 2).join("/") || parts[0] || "";
-}
-
-function goCacheRoots() {
-  const roots = [];
-  if (process.env.GOMODCACHE) roots.push(...String(process.env.GOMODCACHE).split(delimiter));
-  for (const gp of String(process.env.GOPATH || join(homedir(), "go")).split(delimiter)) roots.push(join(gp, "pkg", "mod"));
-  return [...new Set(roots.filter(existingDir))];
-}
-
-function goModCacheEscape(modulePath) {
-  return String(modulePath || "").split("/").map((part) => part.replace(/[A-Z]/g, (c) => `!${c.toLowerCase()}`)).join("/");
-}
-
-function goModuleSourceRoots(installed) {
-  const roots = [];
-  const caches = goCacheRoots();
-  const goPkgs = (installed || []).filter((p) => p.ecosystem === "Go" && p.name && p.version);
-  for (const p of goPkgs) {
-    const mod = goModCacheEscape(p.name);
-    const ver = String(p.version).startsWith("v") ? String(p.version) : `v${p.version}`;
-    for (const cache of caches) {
-      const dir = join(cache, `${mod}@${ver}`);
-      if (existingDir(dir)) roots.push({ kind: "Go", root: dir, packages: 1, pathToPkg: () => p.name });
-    }
-  }
-  return roots;
-}
-
-export function buildContentRoots(repoPath, installed) {
-  const roots = [];
-  const nmDir = join(repoPath, "node_modules");
-  const jsPkgDirs = existingDir(nmDir) ? listPkgDirs(nmDir) : [];
-  // Scan installed package roots, not the whole node_modules container. Package-manager caches,
-  // hosted release snapshots and other hidden metadata are not installed dependencies and may
-  // legitimately contain malware-signature fixtures (including Weavatrix's own rule source).
-  for (const item of jsPkgDirs) roots.push({ kind: "npm", root: item.dir, packages: 1, pathToPkg: pkgOfNodeModulesPath });
-
-  for (const sp of sitePackageRoots(repoPath)) {
-    const topMap = pyTopLevelMap(sp);
-    let packages = 0;
-    try { packages = readdirSync(sp).filter((e) => !e.startsWith(".") && !/\.dist-info$|\.egg-info$|__pycache__/i.test(e)).length; } catch { /* unreadable */ }
-    roots.push({ kind: "PyPI", root: sp, packages, pathToPkg: (file) => pkgOfSitePackagesPath(file, sp, topMap) });
-  }
-
-  const vendorRoot = join(repoPath, "vendor");
-  if (existingDir(vendorRoot)) {
-    const modules = vendorModuleNames(installed);
-    roots.push({ kind: "Go", root: vendorRoot, packages: modules.length || 1, pathToPkg: (file) => pkgOfVendorPath(file, vendorRoot, modules) });
-  }
-  roots.push(...goModuleSourceRoots(installed));
-  return roots;
-}
-
-export function listPkgDirs(nmDir) {
-  const out = [];
-  let entries;
-  try { entries = readdirSync(nmDir); } catch { return out; }
-  for (const e of entries) {
-    if (e.startsWith(".")) continue;
-    if (e.startsWith("@")) {
-      let scoped; try { scoped = readdirSync(join(nmDir, e)); } catch { continue; }
-      for (const s of scoped) out.push({ pkg: `${e}/${s}`, dir: join(nmDir, e, s) });
-    } else out.push({ pkg: e, dir: join(nmDir, e) });
-  }
-  return out;
-}

package/src/security/malware-heuristics.scan.js

@@ -1,89 +0,0 @@
-// scanMalware orchestration (split out of malware-heuristics.js): phase A install scripts +
-// lockfile origins, phase B content sweep, path-aware file heuristics, then scoring.
-import { readFileSync, existsSync } from "node:fs";
-import { join } from "node:path";
-import { resolveRg } from "../scan/search.js";
-import { classifyInstallScript, classifyResolvedUrl, isCloudSdkMetadataUse } from "./registry-sig.js";
-import { fileHeuristicSweep } from "./malware-file-heuristics.js";
-import { buildMalwareFindings } from "./malware-scoring.js";
-import { parseMalwareExclusions, isManifestUrlNoise, isDocUrlNoise, isMalwareSignalExcluded, installScriptSnippet } from "./malware-heuristics.exclusions.js";
-import { buildContentRoots, listPkgDirs } from "./malware-heuristics.roots.js";
-import { rgSweep, nodeSweep } from "./malware-heuristics.sweep.js";
-
-// → { findings, scanMode } ; importedPkgs = Set of packages the repo's own code imports (evidence note).
-export async function scanMalware(repoPath, { installed = [], importedPkgs = new Set(), rgPath = "", forceNode = false, timeoutMs = 60000, malwareExclusions = {} } = {}) {
-  const nmDir = join(repoPath, "node_modules");
-  const contentRoots = buildContentRoots(repoPath, installed);
-  const byPkg = new Map(); // pkg -> [{rule signal, file, line, snippet}]
-  const exclusions = parseMalwareExclusions(malwareExclusions);
-  let excludedSignals = 0;
-  const add = (pkg, sig, file = "", line = 0, snippet = "") => {
-    if (!pkg) return;
-    const signal = { ...sig, file, line, snippet: snippet || sig.snippet || "" };
-    if (isManifestUrlNoise(file, signal) || isDocUrlNoise(file, signal) || isCloudSdkMetadataUse(pkg, signal.key) || isMalwareSignalExcluded(pkg, signal, exclusions)) {
-      excludedSignals++;
-      return;
-    }
-    (byPkg.get(pkg) || byPkg.set(pkg, []).get(pkg)).push(signal);
-  };
-
-  // ---- phase A: install scripts (from node_modules package.jsons) + lockfile resolved origins ----
-  const pkgDirs = existsSync(nmDir) ? listPkgDirs(nmDir) : [];
-  const lockScriptMeta = new Map(
-    (installed || [])
-      .filter((p) => p.ecosystem === "npm" && p.source === "package-lock" && p.hasInstallScript !== undefined)
-      .map((p) => [`${p.name}@${p.version}`, !!p.hasInstallScript])
-  );
-  for (const { pkg, dir } of pkgDirs) {
-    try {
-      const pj = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
-      // package-lock hasInstallScript describes install-time hooks. Development and
-      // publication hooks such as prepare do not constitute drift from that flag.
-      const scriptSnippet = installScriptSnippet(pj.scripts);
-      if (scriptSnippet && lockScriptMeta.get(`${pkg}@${pj.version || ""}`) === false) {
-        add(pkg, {
-          key: "install-script-drift",
-          severity: "high",
-          nearZeroFp: false,
-          what: "installed package has lifecycle scripts absent from package-lock metadata",
-          snippet: scriptSnippet,
-        }, join(dir, "package.json"));
-      }
-      for (const sig of classifyInstallScript(pj.scripts)) add(pkg, sig, join(dir, "package.json"));
-    } catch { /* not a package */ }
-  }
-  for (const p of installed) {
-    const sig = p.resolved ? classifyResolvedUrl(p.resolved) : null;
-    if (sig) add(p.name, sig, "package-lock.json");
-  }
-
-  // ---- phase B: content sweep ----
-  let scanMode = "none";
-  if (contentRoots.length) {
-    const rg = forceNode ? null : await resolveRg("auto", rgPath);
-    let swept = false;
-    if (rg) {
-      const { hits, errored, total } = await rgSweep(rg, contentRoots, timeoutMs);
-      if (errored < total) {
-        // honest label: full when every rule ran, partial when some rules failed (don't claim
-        // full coverage we didn't get); every-rule-failed falls through to the Node sweep below.
-        const kinds = [...new Set(contentRoots.map((r) => r.kind))].join("+");
-        scanMode = errored ? `ripgrep-partial (${total - errored}/${total} sweeps; ${kinds})` : `ripgrep-full (${kinds})`;
-        swept = true;
-        for (const h of hits) add(h.pkg, h.rule, h.file, h.line, h.text);
-      }
-    }
-    if (!swept) {
-      scanMode = rg ? "node-limited (ripgrep failed)" : "node-limited";
-      for (const h of nodeSweep(nmDir, pkgDirs)) add(h.pkg, h.rule, h.file, h.line, h.text);
-    }
-  } else {
-    scanMode = "skipped";
-  }
-
-  // ---- path-aware cheap checks: things that need file names or magic bytes, not just regex text.
-  // These run regardless of rg availability and stay bounded; content regex still does the broad sweep.
-  for (const h of fileHeuristicSweep(contentRoots, pkgDirs)) add(h.pkg, h.rule, h.file, h.line, h.text);
-
-  return buildMalwareFindings({ byPkg, importedPkgs, contentRoots, scanMode, excludedSignals });
-}

package/src/security/malware-heuristics.sweep.js

@@ -1,122 +0,0 @@
-// Content sweeps for the malware scanner (split out of malware-heuristics.js): a ripgrep sweep
-// over all content roots when rg is available, else a bounded Node fallback over entry files.
-import { readFileSync, readdirSync, existsSync, statSync } from "node:fs";
-import { join } from "node:path";
-import { runCommand } from "../process.js";
-import { CONTENT_RULES, classifyContent } from "./registry-sig.js";
-import { normPath } from "./malware-heuristics.exclusions.js";
-
-const SKIP_GLOBS = [
-  "!**/*.map", "!**/*.md", "!**/*.mdx", "!**/*.markdown", "!**/*.mdown", "!**/*.mkd", "!**/*.rst", "!**/*.d.ts",
-  "!**/doc/**", "!**/docs/**", "!**/documentation/**",
-  "!**/test/**", "!**/tests/**", "!**/__tests__/**", "!**/fixtures/**", "!**/example/**", "!**/examples/**"
-];
-
-function globalRuleRegex(rule) {
-  const flags = rule.re.flags.includes("g") ? rule.re.flags : `${rule.re.flags}g`;
-  return new RegExp(rule.re.source, flags);
-}
-
-function matchRuleOffsets(rule, lineText, subText = "") {
-  const text = String(lineText || "");
-  if (text) {
-    const offsets = [];
-    const re = globalRuleRegex(rule);
-    let guard = 0;
-    let m;
-    while ((m = re.exec(text)) && guard++ < 24) {
-      offsets.push(m.index);
-      if (!m[0].length) re.lastIndex++;
-    }
-    if (!offsets.length && rule.key === "obfuscated-code") {
-      const at = subText ? text.indexOf(subText) : 0;
-      if (at >= 0) offsets.push(at);
-    }
-    return offsets;
-  }
-  if (subText && (rule.key === "obfuscated-code" || rule.re.test(subText))) return [0];
-  return [];
-}
-
-function rootOfFile(file, roots) {
-  const f = normPath(file).toLowerCase();
-  return roots.find((r) => {
-    const root = normPath(r.root).toLowerCase();
-    return f === root || f.startsWith(`${root}/`);
-  });
-}
-
-function chunks(list, size) {
-  const out = [];
-  for (let i = 0; i < list.length; i += size) out.push(list.slice(i, i + size));
-  return out;
-}
-
-export async function rgSweep(rg, contentRoots, timeoutMs) {
-  const hits = []; // {pkg, file, line, text, rule}
-  let errored = 0; // a failed/broken rule must not masquerade as "scanned, 0 hits"
-  let total = 0;
-  for (const rule of CONTENT_RULES) {
-    for (const group of chunks(contentRoots, 40)) {
-      total++;
-      const args = ["--json", "-i", "--no-ignore", "--hidden", "--follow", "--max-filesize", "2M", "--max-count", "20", ...SKIP_GLOBS.flatMap((g) => ["-g", g]), "-e", rule.pattern, "--", ...group.map((r) => r.root)];
-      let r;
-      try { r = await runCommand(rg, args, { timeoutMs }); } catch { errored++; continue; }
-      if (r.exitCode === 2 && !String(r.stdout || "").trim()) { errored++; continue; }
-      for (const line of String(r.stdout || "").split(/\r?\n/)) {
-        if (!line) continue;
-        let obj; try { obj = JSON.parse(line); } catch { continue; }
-        if (obj.type !== "match") continue;
-        const file = obj.data?.path?.text || "";
-        const root = rootOfFile(file, group);
-        const pkg = root?.pathToPkg(file) || "";
-        if (!pkg) continue;
-        const lineText = String(obj.data?.lines?.text || "");
-        const subText = String(obj.data?.submatches?.[0]?.match?.text || "");
-        for (const at of matchRuleOffsets(rule, lineText, subText)) {
-          const text = (lineText ? lineText.slice(Math.max(0, at - 160), at + 180) : subText).trim().slice(0, 340);
-          hits.push({ pkg, file, line: obj.data?.line_number || 0, text, rule });
-        }
-      }
-    }
-  }
-  return { hits, errored, total };
-}
-
-// no-rg fallback: each package's package.json main/bin entries + root JS files, bounded
-export function nodeSweep(nmDir, pkgDirs, capFiles = 3000) {
-  const hits = [];
-  let seenFiles = 0;
-  for (const { pkg, dir } of pkgDirs) {
-    if (seenFiles >= capFiles) break;
-    let pj = null;
-    try { pj = JSON.parse(readFileSync(join(dir, "package.json"), "utf8")); } catch { continue; }
-    const cands = new Set();
-    for (const f of [pj.main, pj.module, pj.browser]) if (typeof f === "string") cands.add(f);
-    if (pj.bin) for (const b of typeof pj.bin === "string" ? [pj.bin] : Object.values(pj.bin)) cands.add(b);
-    let rootJs = [];
-    try { rootJs = readdirSync(dir).filter((f) => /\.(c|m)?js$/.test(f)).slice(0, 6); } catch { /* gone */ }
-    for (const f of rootJs) cands.add(f);
-    if (!cands.size) cands.add("index.js");
-    for (const rel of cands) {
-      if (seenFiles >= capFiles) break;
-      const full = join(dir, String(rel));
-      try {
-        if (!existsSync(full) || statSync(full).size > 2_000_000) continue;
-        seenFiles++;
-        const text = readFileSync(full, "utf8");
-        for (const rule of classifyContent(text)) {
-          for (const at of matchRuleOffsets(rule, text)) {
-            // snippet keeps up to 60 chars of same-line PRE-context (like the rg path) so the
-            // comment/doc-context noise filter can see "// see" markers before the match
-            const lineStart = text.lastIndexOf("\n", at) + 1;
-            const nl = text.indexOf("\n", at);
-            const snippet = text.slice(Math.max(lineStart, at - 60), Math.min(nl < 0 ? text.length : nl, at + 200)).trim().slice(0, 240);
-            hits.push({ pkg, file: full, line: at >= 0 ? text.slice(0, at).split("\n").length : 0, text: snippet, rule });
-          }
-        }
-      } catch { /* unreadable */ }
-    }
-  }
-  return hits;
-}

package/src/security/malware-scoring.js

@@ -1,105 +0,0 @@
-import { makeFinding } from "../analysis/findings.js";
-import { MALWARE_ALLOWLIST } from "./registry-sig.js";
-import { classifyTyposquat } from "./typosquat.js";
-
-const STRONG_URL_KEYS = new Set(["exfil-url", "exfil-ip", "cloud-metadata-url", "network-url"]);
-
-function addTyposquatCoSignals(byPkg) {
-  for (const pkg of [...byPkg.keys()]) {
-    if (!byPkg.get(pkg).some((s) => !s.weak)) continue;
-    const sq = classifyTyposquat(pkg);
-    if (!sq) continue;
-    byPkg.get(pkg).push({
-      key: "typosquat",
-      severity: "medium",
-      nearZeroFp: false,
-      what: `name resembles "${sq.nearest}" (edit distance ${sq.distance})`,
-      snippet: `${pkg} ~= ${sq.nearest}`,
-    });
-  }
-}
-
-function visibleSignals(signals, allow) {
-  const kept = signals.filter((s) => !(allow && s.noisy));
-  if (!kept.length) return [];
-  // A literal URL, or even a network call to one, is ordinary package behavior without a second
-  // security signal. Keep those weak observations available as co-evidence (for example beside
-  // environment harvesting), but never create a standalone malware finding from them.
-  if (!kept.some((s) => !s.weak)) return [];
-  const hasStrongerUrl = kept.some((s) => STRONG_URL_KEYS.has(s.key));
-  return hasStrongerUrl ? kept.filter((s) => s.key !== "hardcoded-url") : kept;
-}
-
-// Heuristic source matches can justify urgent review, but they cannot prove that code executed or
-// credentials left the machine. Reserve `critical` for independently confirmed advisories/runtime
-// evidence; this scanner therefore has an explicit HIGH ceiling.
-function heuristicSeverity(baseSeverity, smoking, multi) {
-  if (baseSeverity === "critical") return "high";
-  if ((smoking || multi) && (baseSeverity === "medium" || baseSeverity === "low")) return "high";
-  return baseSeverity;
-}
-
-function evidenceRows(signals) {
-  const seen = new Set();
-  const rows = [];
-  for (const s of signals) {
-    const row = {
-      file: String(s.file).replace(/\\/g, "/"),
-      line: s.line || 0,
-      snippet: s.snippet.slice(0, 200),
-    };
-    const key = `${row.file}\0${row.line}\0${row.snippet}`;
-    if (seen.has(key)) continue;
-    seen.add(key);
-    rows.push(row);
-    if (rows.length >= 6) break;
-  }
-  return rows;
-}
-
-export function buildMalwareFindings({ byPkg, importedPkgs, contentRoots, scanMode, excludedSignals }) {
-  addTyposquatCoSignals(byPkg);
-  const findings = [];
-  for (const [pkg, signals] of byPkg) {
-    const visible = visibleSignals(signals, MALWARE_ALLOWLIST.has(pkg));
-    if (!visible.length) continue;
-    const keys = new Set(visible.map((s) => s.key));
-    const smoking = visible.some((s) => s.nearZeroFp);
-    const escalationKeys = new Set(visible.filter((s) => !s.weak).map((s) => s.key));
-    const multi = escalationKeys.size >= 2;
-    for (const key of keys) {
-      const ofKey = visible.filter((s) => s.key === key);
-      const base = ofKey[0];
-      const severity = heuristicSeverity(base.severity, smoking, multi);
-      findings.push(makeFinding({
-        category: "malware",
-        rule: key,
-        severity,
-        confidence: base.nearZeroFp ? "high" : multi ? "medium" : "low",
-        assessment: "SUSPICIOUS_STATIC_EVIDENCE",
-        confirmedExecution: false,
-        requiresRuntimeConfirmation: true,
-        severityCeiling: "high",
-        title: `${base.what}: ${pkg}`,
-        detail: `${base.what} in installed package "${pkg}"${multi ? ` - co-occurs with ${[...keys].filter((k) => k !== key).join(", ")} (escalated)` : ""}${importedPkgs.has(pkg) ? ". This package IS imported by the repo's own code." : ". Transitive install (its install scripts may have run)."} Static heuristic evidence only: execution, package compromise, and credential exposure are NOT confirmed. Inspect the cited file and verify origin/lockfile/runtime evidence before acting.`,
-        package: pkg,
-        file: base.file ? String(base.file).replace(/\\/g, "/") : "",
-        line: base.line || 0,
-        evidence: evidenceRows(ofKey),
-        source: "heuristic",
-        verification: {
-          staticPattern: "MATCHED",
-          runtimeExecution: "NOT_VERIFIED",
-          packageOrigin: "NOT_VERIFIED",
-          lockfileIntegrity: "NOT_VERIFIED",
-          credentialExposure: "NOT_VERIFIED",
-          decision: "MANUAL_CONFIRMATION_REQUIRED",
-        },
-        fixHint: smoking
-          ? `quarantine and inspect ${pkg}; verify package origin and lockfile integrity before removal; rotate secrets only if execution or credential exposure is confirmed`
-          : `review the cited code in ${pkg}`,
-      }));
-    }
-  }
-  return { findings, scanMode, packagesScanned: contentRoots.reduce((n, r) => n + (r.packages || 0), 0), excludedSignals };
-}

package/src/security/match.js

@@ -1,85 +0,0 @@
-// Pure OSV advisory matcher — installed {ecosystem,name,version} × advisory affected[] → hits.
-// From-scratch lite version comparator (semver-ish + PyPI epoch), NO deps. Exact `versions[]`
-// membership is preferred (confidence high); range evaluation is the fallback (confidence medium) —
-// per DEPS_SECURITY_PLAN P4: when unsure, label lower confidence rather than guessing "vulnerable".
-export function parseVersion(v) {
-  let s = String(v || "").trim().replace(/^[v=]/, "");
-  let epoch = 0;
-  const em = s.match(/^(\d+)!(.*)$/); // PyPI epoch "1!2.0"
-  if (em) { epoch = Number(em[1]); s = em[2]; }
-  s = s.split("+")[0]; // build metadata never orders
-  const dash = s.indexOf("-");
-  const core = dash < 0 ? s : s.slice(0, dash);
-  const pre = dash < 0 ? [] : s.slice(dash + 1).split(".").filter(Boolean);
-  const nums = core.split(".").map((x) => { const n = parseInt(x, 10); return Number.isFinite(n) ? n : 0; });
-  return { epoch, nums, pre };
-}
-
-export function compareVersions(a, b) {
-  const pa = parseVersion(a), pb = parseVersion(b);
-  if (pa.epoch !== pb.epoch) return pa.epoch - pb.epoch;
-  for (let i = 0; i < Math.max(pa.nums.length, pb.nums.length); i++) {
-    const x = pa.nums[i] || 0, y = pb.nums[i] || 0;
-    if (x !== y) return x - y;
-  }
-  if (!pa.pre.length && pb.pre.length) return 1;  // release > its pre-release
-  if (pa.pre.length && !pb.pre.length) return -1;
-  for (let i = 0; i < Math.max(pa.pre.length, pb.pre.length); i++) {
-    const x = pa.pre[i], y = pb.pre[i];
-    if (x === undefined) return -1;
-    if (y === undefined) return 1;
-    const nx = /^\d+$/.test(x), ny = /^\d+$/.test(y);
-    if (nx && ny) { if (Number(x) !== Number(y)) return Number(x) - Number(y); }
-    else if (nx !== ny) return nx ? -1 : 1; // numeric identifiers order before alphanumeric (semver)
-    else { const c = x < y ? -1 : x > y ? 1 : 0; if (c) return c; }
-  }
-  return 0;
-}
-
-// affected = one OSV `affected[]` entry (already filtered to this package): {versions?, ranges?}.
-// Returns { hit, by: "versions"|"range"|"range-open", confidence } — GIT ranges are skipped (commit
-// hashes aren't comparable to release versions).
-export function isVersionAffected(version, affected = {}) {
-  if (Array.isArray(affected.versions) && affected.versions.length) {
-    const norm = String(version).replace(/^v/, "");
-    if (affected.versions.some((x) => String(x).replace(/^v/, "") === norm)) return { hit: true, by: "versions", confidence: "high" };
-    // NOT a short-circuit: OSV's enumerated versions[] is often incomplete while ranges[] stays
-    // authoritative (that's what the server-side querybatch matches on). Falling through to the
-    // ranges below is what stops "querybatch flagged it, but re-analysis shows 0 vulnerabilities".
-  }
-  for (const r of affected.ranges || []) {
-    if (!r || r.type === "GIT") continue;
-    let active = false;
-    for (const e of r.events || []) { // OSV spec: events are sorted
-      if (e.introduced !== undefined) {
-        active = e.introduced === "0" || compareVersions(version, e.introduced) >= 0;
-      } else if (e.fixed !== undefined) {
-        if (active && compareVersions(version, e.fixed) < 0) return { hit: true, by: "range", confidence: "medium" };
-        active = false;
-      } else if (e.last_affected !== undefined) {
-        if (active && compareVersions(version, e.last_affected) <= 0) return { hit: true, by: "range", confidence: "medium" };
-        active = false;
-      }
-    }
-    if (active) return { hit: true, by: "range-open", confidence: "medium" }; // introduced, never fixed
-  }
-  return { hit: false };
-}
-
-// installed: [{ecosystem,name,version,...}]; queryFn(ecosystem, name) → normalized advisory rows
-// [{id, kind: "vuln"|"malicious", severity, summary, url, affected}]. Dedup by (advisory id, package).
-export function matchAdvisories(installed, queryFn) {
-  const hits = [];
-  const seen = new Set();
-  for (const pkg of installed || []) {
-    for (const adv of queryFn(pkg.ecosystem, pkg.name) || []) {
-      const key = `${adv.id}|${pkg.name}|${pkg.version}`;
-      if (seen.has(key)) continue;
-      const m = isVersionAffected(pkg.version, adv.affected || {});
-      if (!m.hit) continue;
-      seen.add(key);
-      hits.push({ pkg, adv, matchedBy: m.by, confidence: m.confidence });
-    }
-  }
-  return hits;
-}