jsdet_cli/

npm2.rs

use std::collections::BTreeMap;
use std::fs;
use std::io;
use std::net::IpAddr;
use std::path::{Component, Path, PathBuf};
use std::sync::Arc;

use anyhow::{Context, Result, bail};
use flate2::read::GzDecoder;
use reqwest::blocking::Client;
use secfinding::Severity;
use serde::Deserialize;
use tempfile::TempDir;
use vulnir::{
    ConfidenceValue, Producer, ProducerKind, Provenance, VulnEdge, VulnIRGraph, VulnNode,
};

use crate::npm_detonation::NpmDetonationBridge;

/// Extension trait for `IpAddr` to provide `is_private()` method.
pub trait IpAddrExt {
    /// Returns `true` if this address is in a private range.
    ///
    /// For IPv4, checks if the address is in a private network range.
    /// For IPv6, checks if the address is a unique local address (fc00::/7).
    fn is_private(&self) -> bool;
}

impl IpAddrExt for IpAddr {
    fn is_private(&self) -> bool {
        match self {
            IpAddr::V4(v4) => v4.is_private(),
            IpAddr::V6(v6) => v6.is_unique_local(),
        }
    }
}

#[derive(Debug, Clone)]
pub struct NpmScanOptions {
    pub detonate: bool,
}

impl Default for NpmScanOptions {
    fn default() -> Self {
        Self { detonate: true }
    }
}

pub type RuleSeverity = Severity;

#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
pub struct PackageFinding {
    pub id: String,
    pub severity: RuleSeverity,
    pub cwe: Option<String>,
    pub file: String,
    pub line: usize,
    pub description: String,
    pub evidence: String,
}

#[must_use]
pub fn severity_label(severity: RuleSeverity) -> &'static str {
    match severity {
        Severity::Critical => "CRITICAL",
        Severity::High => "HIGH",
        Severity::Medium => "MEDIUM",
        Severity::Low => "LOW",
        _ => "INFO",
    }
}

#[derive(Debug, Clone)]
pub struct PackageScanResult {
    pub package_name: String,
    pub package_version: String,
    pub findings: Vec<PackageFinding>,
}

impl PackageScanResult {
    #[must_use]
    pub fn to_vulnir_graph(&self) -> VulnIRGraph<VulnNode, VulnEdge> {
        let mut graph = VulnIRGraph::new();
        let provenance = package_provenance();
        let package_node = graph.add_node(VulnNode::TrustBoundary {
            id: format!("npm-package-{}", self.package_name),
            description: format!("npm package {}@{}", self.package_name, self.package_version),
            source_type: "npm-package".to_string(),
            confidence: ConfidenceValue::from(1.0),
            taint_id: Some(self.package_name.clone()),
            created_ns: None,
            provenance: vec![provenance.clone()],
            metadata: BTreeMap::from([
                (
                    "package_name".to_string(),
                    serde_json::json!(&self.package_name),
                ),
                (
                    "package_version".to_string(),
                    serde_json::json!(&self.package_version),
                ),
            ])
            .into_iter()
            .collect(),
        });

        for finding in &self.findings {
            let node = graph.add_node(VulnNode::Capability {
                id: finding.id.clone(),
                resource: "npm-package-analysis".to_string(),
                permission: severity_label(finding.severity).to_ascii_lowercase(),
                target: Some(finding.file.clone()),
                arguments: vec![finding.description.clone(), finding.evidence.clone()],
                duration_ns: None,
                provenance: vec![provenance.clone()],
                metadata: BTreeMap::from([
                    ("rule_id".to_string(), serde_json::json!(&finding.id)),
                    ("line".to_string(), serde_json::json!(finding.line)),
                    ("cwe".to_string(), serde_json::json!(&finding.cwe)),
                ])
                .into_iter()
                .collect(),
            });
            graph.add_edge(
                package_node,
                node,
                VulnEdge::DataFlow {
                    confidence: ConfidenceValue::from(1.0),
                },
            );
        }

        graph
    }
}

#[must_use]
pub fn vulnir_json(graph: &VulnIRGraph<VulnNode, VulnEdge>) -> serde_json::Value {
    serde_json::json!({
        "nodes": graph.node_indices().map(|index| serde_json::json!({
            "index": index.index(),
            "node": &graph[index],
        })).collect::<Vec<_>>(),
        "edges": graph.edge_indices().filter_map(|index| {
            graph.edge_endpoints(index).map(|(source, target)| serde_json::json!({
                "source": source.index(),
                "target": target.index(),
                "edge": &graph[index],
            }))
        }).collect::<Vec<_>>(),
    })
}

pub fn scan_npm_package(path: impl AsRef<Path>) -> Result<PackageScanResult> {
    scan_npm_package_with_options(path, &NpmScanOptions::default())
}

pub fn scan_npm_package_with_options(
    path: impl AsRef<Path>,
    options: &NpmScanOptions,
) -> Result<PackageScanResult> {
    let resolved = resolve_scan_target(path.as_ref())?;
    let package_json_path = resolved.root.join("package.json");
    let (package_json, manifest) = if package_json_path.is_file() {
        let package_json = fs::read_to_string(&package_json_path).with_context(|| {
            format!(
                "failed to read package manifest at {}. Fix: provide a readable package.json",
                package_json_path.display()
            )
        })?;
        let manifest: PackageManifest = serde_json::from_str(&package_json).with_context(|| {
            format!(
                "failed to parse {}. Fix: ensure package.json is valid JSON",
                package_json_path.display()
            )
        })?;
        (package_json, manifest)
    } else {
        (
            "{}".to_string(),
            PackageManifest::from_directory(&resolved.root, resolved.display_name.clone()),
        )
    };

    let files = collect_scan_files(&resolved.root)?;
    if manifest.scripts.is_empty() && files.is_empty() && !package_json_path.is_file() {
        return Ok(PackageScanResult {
            package_name: manifest.name,
            package_version: manifest.version,
            findings: Vec::new(),
        });
    }

    let rules = load_rules(&workspace_rules_dir())?;
    let corpus = PackageCorpus::new(&package_json, manifest.clone(), &files);
    let mut findings = Vec::new();

    for rule in rules {
        if !rule.matches(&corpus) {
            continue;
        }

        let evidence_token = rule.primary_evidence_token();
        let (file, line, evidence) = corpus.find_evidence_location(evidence_token);
        findings.push(PackageFinding {
            id: rule.id,
            severity: rule.severity,
            cwe: rule.cwe,
            file,
            line,
            description: format!("{} Fix: {}", rule.title, rule.description),
            evidence,
        });
    }

    if options.detonate {
        findings.extend(run_dynamic_detonation(&resolved.root, &files)?);
    }

    dedupe_findings(&mut findings);
    findings.sort_by(|left, right| {
        right
            .severity
            .cmp(&left.severity)
            .then_with(|| left.id.cmp(&right.id))
            .then_with(|| left.file.cmp(&right.file))
            .then_with(|| left.line.cmp(&right.line))
    });

    Ok(PackageScanResult {
        package_name: manifest.name,
        package_version: manifest.version,
        findings,
    })
}

fn run_dynamic_detonation(package_dir: &Path, files: &[SourceFile]) -> Result<Vec<PackageFinding>> {
    let module = jsdet_core::CompiledModule::new()
        .context("failed to compile QuickJS WASM for npm detonation")?;
    let config = jsdet_core::SandboxConfig::detonation();
    let mut findings = Vec::new();

    for source in files.iter().filter(|file| is_javascript(&file.path)) {
        if source.text.len() > config.max_script_bytes {
            continue;
        }
        let bridge = Arc::new(NpmDetonationBridge::new(package_dir, &source.path)?);
        let result = module.execute(&[wrap_script(source)], bridge, &config)?;
        findings.extend(dynamic_findings_for_script(source, &result.observations));
    }

    Ok(findings)
}

fn dynamic_findings_for_script(
    source: &SourceFile,
    observations: &[jsdet_core::Observation],
) -> Vec<PackageFinding> {
    let mut findings = Vec::new();

    for observation in observations {
        let jsdet_core::Observation::ApiCall { api, args, .. } = observation else {
            continue;
        };
        match api.as_str() {
            "eval" | "eval.tainted" => findings.push(build_finding(
                source,
                "npm-dynamic-eval-external-input",
                if api == "eval.tainted" {
                    Severity::Critical
                } else {
                    Severity::High
                },
                Some("CWE-95"),
                "Dynamic code execution via eval() with external or tainted input. Fix: remove eval() or validate and parse untrusted data before execution.",
                &first_non_empty(&args_json_strings(args).join(" "), "eval"),
            )),
            "Function" | "Function.tainted" => findings.push(build_finding(
                source,
                "npm-function-constructor-external-input",
                if api == "Function.tainted" {
                    Severity::Critical
                } else {
                    Severity::High
                },
                Some("CWE-95"),
                "Dynamic code execution via Function constructor with external or tainted input. Fix: replace string compilation with explicit functions.",
                &first_non_empty(&args_json_strings(args).join(" "), "Function"),
            )),
            "child_process.exec" | "child_process.execSync" => {
                let command = args_json_strings(args).join(" ");
                findings.push(build_finding(
                    source,
                    "npm-dynamic-command-exec",
                    Severity::Critical,
                    Some("CWE-78"),
                    if looks_like_reverse_shell(&command) {
                        "Command execution with reverse-shell indicators. Fix: remove child_process execution from package install/runtime paths."
                    } else {
                        "Command execution via child_process. Fix: avoid shell execution or hardcode safe commands and arguments."
                    },
                    &first_non_empty(&command, "child_process.exec"),
                ));
            }
            "child_process.spawn" => findings.push(build_finding(
                source,
                if looks_like_reverse_shell(&args_json_strings(args).join(" ")) {
                    "npm-reverse-shell-spawn"
                } else {
                    "npm-child-process-spawn"
                },
                Severity::Critical,
                Some("CWE-78"),
                "Process spawning from package code. Fix: remove runtime process creation or whitelist safe subprocesses in trusted tooling only.",
                &first_non_empty(&args_json_strings(args).join(" "), "child_process.spawn"),
            )),
            "fs.readFileSync" => {
                let path = first_json_string(args).unwrap_or_default();
                if is_sensitive_path(&path) {
                    findings.push(build_finding(
                        source,
                        "npm-sensitive-file-read",
                        Severity::High,
                        Some("CWE-538"),
                        "Sensitive local file read from package code. Fix: remove host file access and consume explicit user-provided inputs instead.",
                        &path,
                    ));
                }
            }
            "process.env.get" => {
                let key = first_json_string(args).unwrap_or_default();
                if is_sensitive_env_key(&key) {
                    findings.push(build_finding(
                        source,
                        "npm-env-secret-access",
                        Severity::High,
                        Some("CWE-526"),
                        "Package reads sensitive environment variables. Fix: stop harvesting secrets from process.env and request explicit credentials through a secure interface.",
                        &key,
                    ));
                }
            }
            "dns.lookup" | "dns.resolveTxt" => {
                let host = first_json_string(args).unwrap_or_default();
                if is_suspicious_dns_query(&host) {
                    findings.push(build_finding(
                        source,
                        "npm-dns-exfiltration",
                        Severity::Critical,
                        Some("CWE-200"),
                        "Suspicious DNS lookup consistent with data exfiltration. Fix: remove DNS-based transport and avoid encoding host data into domain labels.",
                        &host,
                    ));
                }
            }
            "http.get" | "http.request" | "https.get" | "https.request" => {
                let target = first_json_string(args).unwrap_or_default();
                if is_external_target(&target) {
                    findings.push(build_finding(
                        source,
                        "npm-network-exfiltration",
                        Severity::High,
                        Some("CWE-319"),
                        "Outbound network request from package code. Fix: remove unsolicited network calls or gate them behind explicit user configuration.",
                        &target,
                    ));
                }
            }
            "net.connect" | "net.createConnection" => findings.push(build_finding(
                source,
                "npm-net-socket-exfiltration",
                if is_suspicious_ip_or_host(&args_json_strings(args).join(" ")) {
                    Severity::Critical
                } else {
                    Severity::High
                },
                Some("CWE-200"),
                "Raw socket connection from package code. Fix: remove arbitrary outbound socket creation and reverse-shell patterns.",
                &first_non_empty(&args_json_strings(args).join(" "), "net.connect"),
            )),
            "net.write" => {
                let payload = args_json_strings(args).join(" ");
                if looks_like_secret_material(&payload) {
                    findings.push(build_finding(
                        source,
                        "npm-net-secret-exfiltration",
                        Severity::Critical,
                        Some("CWE-200"),
                        "Socket write contains secret or credential material. Fix: stop transmitting harvested data to remote peers.",
                        &first_non_empty(&payload, "net.write"),
                    ));
                }
            }
            "Buffer.from" => {
                let payload = args_json_strings(args).join(" ");
                if looks_like_memory_leak_pattern(&payload) {
                    findings.push(build_finding(
                        source,
                        "npm-buffer-memory-leak",
                        Severity::Medium,
                        Some("CWE-200"),
                        "Buffer operation suggests unsafe memory disclosure or encoding abuse. Fix: avoid exposing raw buffers derived from secrets or uninitialized memory.",
                        &first_non_empty(&payload, "Buffer.from"),
                    ));
                }
            }
            _ => {}
        }
    }

    findings
}

fn dedupe_findings(findings: &mut Vec<PackageFinding>) {
    let mut deduped = BTreeMap::<(String, String, usize, String), PackageFinding>::new();
    for finding in findings.drain(..) {
        let key = (
            finding.id.clone(),
            finding.file.clone(),
            finding.line,
            finding.evidence.clone(),
        );
        deduped
            .entry(key)
            .and_modify(|current| {
                if finding.severity > current.severity {
                    *current = finding.clone();
                }
            })
            .or_insert(finding);
    }
    *findings = deduped.into_values().collect();
}

fn build_finding(
    source: &SourceFile,
    id: &str,
    severity: Severity,
    cwe: Option<&str>,
    description: &str,
    evidence_token: &str,
) -> PackageFinding {
    let (line, evidence) = find_evidence_location(&source.text, evidence_token);
    PackageFinding {
        id: id.to_string(),
        severity,
        cwe: cwe.map(ToOwned::to_owned),
        file: source.path.clone(),
        line,
        description: description.to_string(),
        evidence,
    }
}

fn find_evidence_location(text: &str, token: &str) -> (usize, String) {
    if token.is_empty() {
        return (1, first_non_empty_line(text));
    }
    let normalized = token.trim_matches('"');
    if let Some(index) = text.find(normalized) {
        let line = text[..index].bytes().filter(|byte| *byte == b'\n').count() + 1;
        let evidence = text
            .lines()
            .nth(line.saturating_sub(1))
            .map(str::trim)
            .filter(|line| !line.is_empty())
            .map(ToOwned::to_owned)
            .unwrap_or_else(|| normalized.to_string());
        return (line, evidence);
    }
    (1, first_non_empty(normalized, &first_non_empty_line(text)))
}

fn first_non_empty(primary: &str, fallback: &str) -> String {
    if primary.trim().is_empty() {
        fallback.to_string()
    } else {
        primary.to_string()
    }
}

fn first_non_empty_line(text: &str) -> String {
    text.lines()
        .map(str::trim)
        .find(|line| !line.is_empty())
        .map_or_else(|| "package source".to_string(), ToOwned::to_owned)
}

fn args_json_strings(args: &[jsdet_core::Value]) -> Vec<String> {
    args.iter().flat_map(value_to_strings).collect()
}

fn first_json_string(args: &[jsdet_core::Value]) -> Option<String> {
    args_json_strings(args)
        .into_iter()
        .find(|value| !value.is_empty())
}

fn value_to_strings(value: &jsdet_core::Value) -> Vec<String> {
    match value {
        jsdet_core::Value::String(text, _) | jsdet_core::Value::Json(text, _) => {
            if let Ok(parsed) = serde_json::from_str::<Vec<serde_json::Value>>(text) {
                parsed
                    .into_iter()
                    .filter_map(|item| item.as_str().map(ToOwned::to_owned))
                    .collect()
            } else {
                vec![text.clone()]
            }
        }
        jsdet_core::Value::Bytes(bytes) => vec![String::from_utf8_lossy(bytes).into_owned()],
        jsdet_core::Value::Bool(value) => vec![value.to_string()],
        jsdet_core::Value::Int(value) => vec![value.to_string()],
        jsdet_core::Value::Float(value) => vec![value.to_string()],
        jsdet_core::Value::Undefined | jsdet_core::Value::Null => Vec::new(),
    }
}

fn wrap_script(source: &SourceFile) -> String {
    let dirname = Path::new(&source.path).parent().map_or_else(
        || ".".to_string(),
        |path| path.to_string_lossy().replace('\\', "/"),
    );
    format!(
        "var __filename = {filename}; var __dirname = {dirname};\n{script}",
        filename = serde_json::to_string(&source.path).unwrap_or_else(|_| "\"index.js\"".into()),
        dirname = serde_json::to_string(&dirname).unwrap_or_else(|_| "\".\"".into()),
        script = source.text
    )
}

fn workspace_rules_dir() -> PathBuf {
    Path::new(env!("CARGO_MANIFEST_DIR"))
        .join("..")
        .join("..")
        .join("rules")
}

fn load_rules(rules_dir: &Path) -> Result<Vec<Rule>> {
    let mut entries = fs::read_dir(rules_dir)
        .with_context(|| {
            format!(
                "failed to read rules directory {}. Fix: ensure the workspace rules/ directory exists",
                rules_dir.display()
            )
        })?
        .collect::<std::io::Result<Vec<_>>>()
        .with_context(|| format!("failed to enumerate {}", rules_dir.display()))?;
    entries.sort_by_key(|entry| entry.path());

    let mut rules = Vec::new();
    for entry in entries {
        let path = entry.path();
        if path.extension().and_then(std::ffi::OsStr::to_str) != Some("toml") {
            continue;
        }
        let Some(file_name) = path.file_name().and_then(std::ffi::OsStr::to_str) else {
            continue;
        };
        if !file_name.starts_with("npm-") {
            continue;
        }
        let text = fs::read_to_string(&path)
            .with_context(|| format!("failed to read rule file {}", path.display()))?;
        let rule: Rule = toml::from_str(&text).with_context(|| {
            format!(
                "failed to parse {}. Fix: make the rule valid TOML matching the scanner schema",
                path.display()
            )
        })?;
        rules.push(rule);
    }

    if rules.is_empty() {
        bail!(
            "no npm rules loaded from {}. Fix: add TOML rule files under rules/",
            rules_dir.display()
        );
    }

    Ok(rules)
}

fn collect_scan_files(package_dir: &Path) -> Result<Vec<SourceFile>> {
    let mut stack = vec![package_dir.to_path_buf()];
    let mut files = Vec::new();
    while let Some(dir) = stack.pop() {
        for entry in fs::read_dir(&dir)
            .with_context(|| format!("failed to read directory {}", dir.display()))?
        {
            let entry =
                entry.with_context(|| format!("failed to read entry in {}", dir.display()))?;
            let path = entry.path();
            let file_type = entry
                .file_type()
                .with_context(|| format!("failed to inspect {}", path.display()))?;
            if file_type.is_dir() {
                let name = entry.file_name().to_string_lossy().into_owned();
                if name == "node_modules" || name == ".git" || name == "target" {
                    continue;
                }
                stack.push(path);
                continue;
            }
            if !file_type.is_file() {
                continue;
            }
            let Some(ext) = path.extension().and_then(std::ffi::OsStr::to_str) else {
                continue;
            };
            if !matches!(ext, "js" | "cjs" | "mjs" | "json") {
                continue;
            }
            let text = fs::read_to_string(&path)
                .with_context(|| format!("failed to read source file {}", path.display()))?;
            let relative = path
                .strip_prefix(package_dir)
                .unwrap_or(path.as_path())
                .to_string_lossy()
                .replace('\\', "/");
            files.push(SourceFile {
                path: relative,
                text,
            });
        }
    }
    files.sort_by(|left, right| left.path.cmp(&right.path));
    Ok(files)
}

fn is_javascript(path: &str) -> bool {
    path.ends_with(".js") || path.ends_with(".cjs") || path.ends_with(".mjs")
}

fn package_provenance() -> Provenance {
    Provenance::new(
        Producer::new("jsdet-cli-npm", ProducerKind::Static)
            .with_version(env!("CARGO_PKG_VERSION")),
    )
}

#[derive(Debug, Clone)]
struct SourceFile {
    path: String,
    text: String,
}

struct PackageCorpus {
    manifest: PackageManifest,
    package_json_lower: String,
    javascript_lower: String,
    package_lower: String,
    files: Vec<SourceFile>,
    script_names: Vec<String>,
}

impl PackageCorpus {
    fn new(package_json: &str, manifest: PackageManifest, files: &[SourceFile]) -> Self {
        let javascript = files
            .iter()
            .filter(|file| is_javascript(&file.path))
            .map(|file| file.text.as_str())
            .collect::<Vec<_>>()
            .join("\n");
        let package_text = files
            .iter()
            .map(|file| file.text.as_str())
            .collect::<Vec<_>>()
            .join("\n");
        let script_names = manifest.scripts.keys().cloned().collect();
        Self {
            manifest,
            package_json_lower: package_json.to_ascii_lowercase(),
            javascript_lower: javascript.to_ascii_lowercase(),
            package_lower: package_text.to_ascii_lowercase(),
            files: files.to_vec(),
            script_names,
        }
    }

    fn scope_text(&self, scope: RuleScope) -> &str {
        match scope {
            RuleScope::Package => &self.package_lower,
            RuleScope::PackageJson => &self.package_json_lower,
            RuleScope::Javascript => &self.javascript_lower,
        }
    }

    fn find_evidence_location(&self, token: &str) -> (String, usize, String) {
        let token = token.to_ascii_lowercase();
        for file in &self.files {
            if let Some((_, line, evidence)) = find_token(&file.text, &token) {
                return (file.path.clone(), line, evidence);
            }
        }
        ("package.json".to_string(), 1, "package.json".to_string())
    }
}

#[derive(Debug, Clone, Deserialize)]
struct Rule {
    id: String,
    title: String,
    description: String,
    severity: Severity,
    #[serde(default)]
    cwe: Option<String>,
    #[serde(default)]
    scope: RuleScope,
    #[serde(default)]
    all: Vec<String>,
    #[serde(default)]
    any: Vec<String>,
    #[serde(default)]
    package_names: Vec<String>,
    #[serde(default)]
    script_names: Vec<String>,
}

impl Rule {
    fn matches(&self, corpus: &PackageCorpus) -> bool {
        let scope_text = corpus.scope_text(self.scope);
        let has_all = self
            .all
            .iter()
            .all(|needle| scope_text.contains(&needle.to_ascii_lowercase()));
        let has_any = self.any.is_empty()
            || self
                .any
                .iter()
                .any(|needle| scope_text.contains(&needle.to_ascii_lowercase()));
        let matches_package_name = self.package_names.is_empty()
            || self
                .package_names
                .iter()
                .any(|name| corpus.manifest.name.eq_ignore_ascii_case(name));
        let matches_script_name = self.script_names.is_empty()
            || self.script_names.iter().any(|name| {
                corpus
                    .script_names
                    .iter()
                    .any(|script_name| script_name.eq_ignore_ascii_case(name))
            });
        has_all && has_any && matches_package_name && matches_script_name
    }

    fn primary_evidence_token(&self) -> &str {
        self.all
            .first()
            .or_else(|| self.any.first())
            .or_else(|| self.script_names.first())
            .or_else(|| self.package_names.first())
            .map_or("package.json", String::as_str)
    }
}

#[derive(Debug, Clone, Copy, Default, Deserialize)]
#[serde(rename_all = "snake_case")]
enum RuleScope {
    #[default]
    Package,
    PackageJson,
    Javascript,
}

#[derive(Debug, Clone, Default, Deserialize)]
struct PackageManifest {
    #[serde(default)]
    name: String,
    #[serde(default)]
    version: String,
    #[serde(default)]
    scripts: BTreeMap<String, String>,
}

impl PackageManifest {
    fn from_directory(package_dir: &Path, display_name: String) -> Self {
        Self {
            name: if display_name.is_empty() {
                package_dir
                    .file_name()
                    .and_then(std::ffi::OsStr::to_str)
                    .map_or_else(|| "unknown-package".to_string(), ToOwned::to_owned)
            } else {
                display_name
            },
            version: "0.0.0".to_string(),
            scripts: BTreeMap::new(),
        }
    }
}

fn find_token(text: &str, token: &str) -> Option<(usize, usize, String)> {
    let lower = text.to_ascii_lowercase();
    lower.find(token).map(|index| {
        let line = text[..index].bytes().filter(|byte| *byte == b'\n').count() + 1;
        let evidence = text
            .lines()
            .nth(line.saturating_sub(1))
            .map(str::trim)
            .filter(|line_text| !line_text.is_empty())
            .map(ToOwned::to_owned)
            .unwrap_or_else(|| token.to_string());
        (index, line, evidence)
    })
}

struct ResolvedScanTarget {
    _tempdir: Option<TempDir>,
    root: PathBuf,
    display_name: String,
}

fn resolve_scan_target(path: &Path) -> Result<ResolvedScanTarget> {
    if path.exists() {
        if path.is_dir() {
            return Ok(ResolvedScanTarget {
                _tempdir: None,
                root: path.to_path_buf(),
                display_name: path
                    .file_name()
                    .and_then(std::ffi::OsStr::to_str)
                    .map_or_else(String::new, ToOwned::to_owned),
            });
        }
        if is_npm_tarball(path) {
            let tempdir = extract_tarball(path)?;
            let root = locate_package_root(tempdir.path())?;
            return Ok(ResolvedScanTarget {
                _tempdir: Some(tempdir),
                root,
                display_name: String::new(),
            });
        }
        bail!(
            "failed to scan {}. Fix: provide a package directory, tarball, or npm package name",
            path.display()
        );
    }
    download_registry_package(&path.to_string_lossy())
}

fn is_npm_tarball(path: &Path) -> bool {
    let path_text = path.to_string_lossy();
    path_text.ends_with(".tgz") || path_text.ends_with(".tar.gz") || path_text.ends_with(".tar")
}

fn download_registry_package(spec: &str) -> Result<ResolvedScanTarget> {
    let (name, version) = split_package_spec(spec);
    let client = Client::builder()
        .timeout(std::time::Duration::from_secs(30))
        .build()
        .context("failed to build npm registry client")?;
    let metadata: RegistryPackage = client
        .get(format!(
            "https://registry.npmjs.org/{}",
            urlencoding::encode(&name)
        ))
        .header(reqwest::header::USER_AGENT, "jsdet/0.1.0")
        .send()
        .with_context(|| format!("failed to fetch npm metadata for {name}"))?
        .error_for_status()
        .with_context(|| format!("npm registry returned an error for {name}"))?
        .json()
        .with_context(|| format!("failed to parse npm metadata for {name}"))?;
    let resolved_version = version
        .or_else(|| metadata.dist_tags.latest.clone())
        .ok_or_else(|| anyhow::anyhow!("npm package {name} did not expose a resolvable version"))?;
    let manifest = metadata
        .versions
        .get(&resolved_version)
        .ok_or_else(|| anyhow::anyhow!("npm version {resolved_version} not found for {name}"))?;
    let tarball_url = manifest.dist.tarball.clone().ok_or_else(|| {
        anyhow::anyhow!("npm metadata for {name}@{resolved_version} has no tarball URL")
    })?;
    let download_dir = tempfile::tempdir().context("failed to create npm download directory")?;
    let archive_path = download_dir.path().join("package.tgz");
    let mut response = client
        .get(&tarball_url)
        .header(reqwest::header::USER_AGENT, "jsdet/0.1.0")
        .send()
        .with_context(|| format!("failed to download npm tarball from {tarball_url}"))?
        .error_for_status()
        .with_context(|| format!("npm tarball download failed for {name}@{resolved_version}"))?;
    let mut file = fs::File::create(&archive_path)
        .with_context(|| format!("failed to create {}", archive_path.display()))?;
    io::copy(&mut response, &mut file)
        .with_context(|| format!("failed to persist {}", archive_path.display()))?;
    let extracted = extract_tarball(&archive_path)?;
    let root = locate_package_root(extracted.path())?;
    Ok(ResolvedScanTarget {
        _tempdir: Some(extracted),
        root,
        display_name: manifest.name.clone().unwrap_or(name),
    })
}

fn split_package_spec(spec: &str) -> (String, Option<String>) {
    if let Some(stripped) = spec.strip_prefix('@') {
        if let Some(idx) = stripped.rfind('@') {
            let split_at = idx + 1;
            return (
                spec[..split_at].to_string(),
                Some(spec[split_at + 1..].to_string()).filter(|value| !value.is_empty()),
            );
        }
        return (spec.to_string(), None);
    }
    if let Some((name, version)) = spec.rsplit_once('@') {
        return (
            name.to_string(),
            Some(version.to_string()).filter(|value| !value.is_empty()),
        );
    }
    (spec.to_string(), None)
}

#[derive(Debug, Deserialize)]
struct RegistryPackage {
    #[serde(rename = "dist-tags")]
    dist_tags: RegistryDistTags,
    #[serde(default)]
    versions: BTreeMap<String, RegistryVersion>,
}

#[derive(Debug, Default, Deserialize)]
struct RegistryDistTags {
    latest: Option<String>,
}

#[derive(Debug, Default, Deserialize)]
struct RegistryVersion {
    name: Option<String>,
    dist: RegistryDist,
}

#[derive(Debug, Default, Deserialize)]
struct RegistryDist {
    tarball: Option<String>,
}

fn extract_tarball(path: &Path) -> Result<TempDir> {
    let file =
        fs::File::open(path).with_context(|| format!("failed to read {}", path.display()))?;
    let tempdir = tempfile::tempdir().context("failed to create extraction directory")?;
    if matches!(
        path.extension().and_then(|value| value.to_str()),
        Some("tgz" | "gz")
    ) {
        unpack_tar(GzDecoder::new(file), tempdir.path())?;
    } else {
        unpack_tar(file, tempdir.path())?;
    }
    Ok(tempdir)
}

fn unpack_tar(reader: impl io::Read, destination: &Path) -> Result<()> {
    let mut archive = tar::Archive::new(reader);
    for entry in archive
        .entries()
        .context("failed to enumerate tar entries")?
    {
        let mut entry = entry.context("failed to read tar entry")?;
        let raw_path = entry.path().context("failed to read tar entry path")?;
        let path = sanitize_archive_path(&raw_path)?;
        let target = destination.join(path);
        if let Some(parent) = target.parent() {
            fs::create_dir_all(parent)
                .with_context(|| format!("failed to create {}", parent.display()))?;
        }
        entry
            .unpack(&target)
            .with_context(|| format!("failed to unpack {}", target.display()))?;
    }
    Ok(())
}

fn sanitize_archive_path(path: &Path) -> Result<PathBuf> {
    let mut cleaned = PathBuf::new();
    for component in path.components() {
        match component {
            Component::Normal(part) => cleaned.push(part),
            Component::CurDir => {}
            _ => bail!("archive contains unsafe path: {}", path.display()),
        }
    }
    if cleaned.as_os_str().is_empty() {
        bail!("archive contains empty path entry");
    }
    Ok(cleaned)
}

fn locate_package_root(extracted_root: &Path) -> Result<PathBuf> {
    let direct = extracted_root.join("package");
    if direct.join("package.json").exists() {
        return Ok(direct);
    }
    for entry in fs::read_dir(extracted_root)
        .with_context(|| format!("failed to read {}", extracted_root.display()))?
    {
        let entry = entry?;
        let path = entry.path();
        if path.is_dir() && path.join("package.json").exists() {
            return Ok(path);
        }
    }
    bail!("no extracted package root with package.json found")
}

fn is_sensitive_env_key(key: &str) -> bool {
    let lower = key.to_ascii_lowercase();
    ["token", "secret", "key", "passwd", "password", "auth"]
        .iter()
        .any(|needle| lower.contains(needle))
}

fn is_sensitive_path(path: &str) -> bool {
    [
        ".npmrc",
        ".ssh/id_rsa",
        ".ssh/config",
        ".aws/credentials",
        "/etc/passwd",
        "/etc/hostname",
        ".git-credentials",
    ]
    .iter()
    .any(|needle| path.contains(needle))
}

fn is_suspicious_dns_query(host: &str) -> bool {
    let lower = host.to_ascii_lowercase();
    if lower.len() > 60 {
        return true;
    }
    lower.contains("token")
        || lower.contains("secret")
        || lower.contains("passwd")
        || lower.contains("evil")
        || lower
            .split('.')
            .any(|label| label.len() > 20 && label.chars().all(|ch| ch.is_ascii_alphanumeric()))
}

fn is_external_target(target: &str) -> bool {
    target.starts_with("http://") || target.starts_with("https://")
}

fn is_suspicious_ip_or_host(target: &str) -> bool {
    args_like_host_values(target)
        .into_iter()
        .any(|host| match host.parse::<IpAddr>() {
            Ok(ip) => !(ip.is_loopback() || ip.is_private()),
            Err(_) => {
                let lower = host.to_ascii_lowercase();
                lower.contains("evil")
                    || lower.contains("attacker")
                    || lower.ends_with(".example")
                    || lower.ends_with(".invalid")
            }
        })
}

fn looks_like_secret_material(payload: &str) -> bool {
    let lower = payload.to_ascii_lowercase();
    [
        "npm_token",
        "github_token",
        "secret",
        "private key",
        "authtoken",
        "passwd",
    ]
    .iter()
    .any(|needle| lower.contains(needle))
}

fn looks_like_memory_leak_pattern(payload: &str) -> bool {
    let lower = payload.to_ascii_lowercase();
    lower.contains("allocunsafe") || lower.contains("uninitialized")
}

fn looks_like_reverse_shell(command: &str) -> bool {
    let lower = command.to_ascii_lowercase();
    (lower.contains("/bin/sh") || lower.contains("/bin/bash") || lower.contains("powershell"))
        && (lower.contains("/dev/tcp")
            || lower.contains("nc ")
            || lower.contains("netcat")
            || lower.contains("socket")
            || lower.contains("curl "))
}

fn args_like_host_values(target: &str) -> Vec<String> {
    if let Ok(values) = serde_json::from_str::<Vec<serde_json::Value>>(target) {
        return values
            .into_iter()
            .filter_map(|item| item.as_str().map(ToOwned::to_owned))
            .collect();
    }
    vec![target.to_string()]
}