Quarantining the Dependencies Your Agent Adds, Before They Install

// scripts/list-install-scripts.mjs
// Usage: node scripts/list-install-scripts.mjs
import { readFile } from "node:fs/promises";
 
const ABBREV = "application/vnd.npm.install-v1+json";
 
async function hasInstallScript(name, version) {
  const res = await fetch(`https://registry.npmjs.org/${encodeURIComponent(name)}`, {
    headers: { accept: ABBREV },
  });
  if (!res.ok) return { name, version, unknown: true };
  const doc = await res.json();
  const v = doc.versions?.[version];
  return { name, version, hasInstallScript: Boolean(v?.hasInstallScript) };
}
 
// Feed it the output of: npm ls --all --json > tree.json
function flatten(node, out = new Map()) {
  for (const [name, dep] of Object.entries(node.dependencies ?? {})) {
    if (dep.version && !out.has(`${name}@${dep.version}`)) {
      out.set(`${name}@${dep.version}`, { name, version: dep.version });
      flatten(dep, out);
    }
  }
  return out;
}
 
const tree = JSON.parse(await readFile("tree.json", "utf8"));
const all = [...flatten(tree).values()];
 
const results = [];
for (const { name, version } of all) {
  results.push(await hasInstallScript(name, version));
}
 
const withScripts = results.filter((r) => r.hasInstallScript);
console.log(`Total dependencies: ${all.length} / with install scripts: ${withScripts.length}`);
for (const r of withScripts) console.log(`  ${r.name}@${r.version}`);

// scripts/quarantine-score.mjs
// Usage: node scripts/quarantine-score.mjs lodash-es minimist
const ABBREV = "application/vnd.npm.install-v1+json";
 
// Names you actually use, plus widely-used ones: the typosquat comparison set
const KNOWN = ["lodash", "react", "next", "express", "axios", "zod", "minimist", "chalk", "dotenv"];
 
function editDistance(a, b) {
  const d = Array.from({ length: a.length + 1 }, (_, i) =>
    Array.from({ length: b.length + 1 }, (_, j) => (i === 0 ? j : j === 0 ? i : 0)),
  );
  for (let i = 1; i <= a.length; i++) {
    for (let j = 1; j <= b.length; j++) {
      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
      d[i][j] = Math.min(d[i - 1][j] + 1, d[i][j - 1] + 1, d[i - 1][j - 1] + cost);
    }
  }
  return d[a.length][b.length];
}
 
function nearestKnown(name) {
  let best = { name: null, distance: Infinity };
  for (const k of KNOWN) {
    if (k === name) return { name: k, distance: 0 };
    const distance = editDistance(name, k);
    if (distance < best.distance) best = { name: k, distance };
  }
  return best;
}
 
async function inspect(name) {
  const [full, abbrev, dl] = await Promise.all([
    fetch(`https://registry.npmjs.org/${encodeURIComponent(name)}`).then((r) => r.json()),
    fetch(`https://registry.npmjs.org/${encodeURIComponent(name)}`, {
      headers: { accept: ABBREV },
    }).then((r) => r.json()),
    fetch(`https://api.npmjs.org/downloads/point/last-week/${encodeURIComponent(name)}`)
      .then((r) => r.json())
      .catch(() => ({ downloads: 0 })),
  ]);
 
  const latest = full["dist-tags"]?.latest;
  const ageDays = Math.floor((Date.now() - Date.parse(full.time?.created ?? 0)) / 86400000);
  const weekly = dl.downloads ?? 0;
  const near = nearestKnown(name);
  const scripted = Boolean(abbrev.versions?.[latest]?.hasInstallScript);
 
  // Additive. Higher means a human should look.
  let score = 0;
  const reasons = [];
  if (ageDays < 30) { score += 3; reasons.push(`published ${ageDays} days ago`); }
  else if (ageDays < 180) { score += 1; reasons.push(`published ${ageDays} days ago`); }
  if (weekly < 1000) { score += 3; reasons.push(`${weekly} weekly downloads`); }
  else if (weekly < 50000) { score += 1; reasons.push(`${weekly} weekly downloads`); }
  if (near.distance > 0 && near.distance <= 2) {
    score += 4;
    reasons.push(`edit distance ${near.distance} from "${near.name}"`);
  }
  if (scripted) { score += 2; reasons.push("has an install-time script"); }
 
  return { name, version: latest, score, reasons };
}
 
const targets = process.argv.slice(2);
let blocked = 0;
 
for (const name of targets) {
  const r = await inspect(name);
  const verdict = r.score >= 5 ? "HOLD" : "PASS";
  if (r.score >= 5) blocked++;
  console.log(`[${verdict}] ${r.name}@${r.version} score=${r.score}`);
  for (const reason of r.reasons) console.log(`    - ${reason}`);
}
 
process.exit(blocked > 0 ? 1 : 0);

#!/usr/bin/env bash
# scripts/gate-new-deps.sh
set -euo pipefail
 
# Extract only added dependency names from the staged package.json diff
ADDED=$(git diff --cached -U0 -- package.json \
  | grep -E '^\+\s+"[^"]+":' \
  | sed -E 's/^\+\s+"([^"]+)".*/\1/' \
  | grep -vE '^(name|version|description|scripts|type|private|license)$' || true)
 
if [ -z "$ADDED" ]; then
  echo "No new dependencies"
  exit 0
fi
 
echo "Quarantining new dependencies:"
echo "$ADDED" | sed 's/^/  /'
 
# shellcheck disable=SC2086
if ! node scripts/quarantine-score.mjs $ADDED; then
  echo ""
  echo "Quarantine held one or more packages. An agent does not get to clear this."
  echo "Review them, then re-run with QUARANTINE_ACK=1 to pass deliberately."
  [ "${QUARANTINE_ACK:-0}" = "1" ] || exit 1
  echo "Manually cleared via QUARANTINE_ACK"
fi