diff

Documentation

Index

• func KnownSignalNames() map[string]bool
• func NormalizeSignalName(name string) string
• type DiffResult
  • func Compare(target Target, from, to *PackageContents, suspiciousAPIs []string) *DiffResult
• type Heuristic
• type PackageContents
  • func FetchPackageContents(ctx context.Context, root, name, version string) (*PackageContents, error)
  • func LoadLocalContents(dir string) (*PackageContents, error)
• type Signal
• type Target
  • func ParseTarget(s string) (*Target, error)

Functions

func KnownSignalNames

func KnownSignalNames() map[string]bool

func NormalizeSignalName

func NormalizeSignalName(name string) string

Types

type DiffResult

type DiffResult struct {
	SchemaVersion string   `json:"schemaVersion"`
	Target        Target   `json:"target"`
	Signals       []Signal `json:"signals"`
	Score         int      `json:"score"`
	Summary       string   `json:"summary"`
	Disabled      bool     `json:"disabled,omitempty"`
}

DiffResult holds the complete comparison between two package versions.

func Compare

func Compare(target Target, from, to *PackageContents, suspiciousAPIs []string) *DiffResult

Compare runs all heuristics against two package versions and returns a DiffResult.

type Heuristic

type Heuristic func(from, to *PackageContents) []Signal

Heuristic is a function that analyzes two package versions and returns signals.

type PackageContents

type PackageContents struct {
	PackageJSON map[string]any    // parsed package.json
	Files       map[string][]byte // relative path -> content
	FileList    []string          // sorted list of file paths
}

PackageContents represents the expanded contents of a package tarball.

func FetchPackageContents

func FetchPackageContents(ctx context.Context, root, name, version string) (*PackageContents, error)

FetchPackageContents downloads and expands a package tarball from the registry.

func LoadLocalContents

func LoadLocalContents(dir string) (*PackageContents, error)

LoadLocalContents reads package contents from a local directory.

type Signal

type Signal struct {
	ID       string         `json:"id"`
	Severity model.Severity `json:"severity"`
	Title    string         `json:"title"`
	Message  string         `json:"message"`
	File     string         `json:"file,omitempty"`
	Line     int            `json:"line,omitempty"`
	Evidence map[string]any `json:"evidence,omitempty"`
}

Signal represents a single risk signal found during diff comparison.

type Target

type Target struct {
	Package string `json:"package"`
	From    string `json:"from"`
	To      string `json:"to"`
}

Target holds the parsed diff target.

func ParseTarget

func ParseTarget(s string) (*Target, error)

ParseTarget parses a string like "axios@1.7.9..1.8.0" into a Target.