| 338 | } |
| 339 | |
| 340 | const isRegistryNode = (node) => { |
| 341 | // Prefer arborist's edge-based check when available (real Node objects). |
| 342 | // It inspects the incoming edges' specs and only returns true if every |
| 343 | // edge resolves to a registry spec, which is much harder to spoof than |
| 344 | // the URL. |
| 345 | if (typeof node.isRegistryDependency === 'boolean') { |
| 346 | return node.isRegistryDependency |
| 347 | } |
| 348 | // Fall back to URL parsing for nodes without the arborist getter |
| 349 | // (e.g. test fixtures, lockfiles with omit-lockfile-registry-resolved). |
| 350 | // Treat the node as a registry dep when: |
| 351 | // - resolved is missing entirely (omitLockfileRegistryResolved), |
| 352 | // - resolved is an https/http URL pointing at a registry tarball, or |
| 353 | // - resolved is undefined and the node has a version (defensive). |
| 354 | if (!node.resolved) { |
| 355 | return !!node.version |
| 356 | } |
| 357 | // Registry tarballs live at `<host>/<pkg-name>/-/<pkg-name>-<version>.tgz`. |
| 358 | // Require a path segment before `/-/` so an attacker can't lift a |
| 359 | // registry-style allow entry to a hostile URL like |
| 360 | // `https://evil.com/-/trusted-1.0.0.tgz`. |
| 361 | return /^https?:\/\/[^/]+\/.+\/-\/[^/]+-\d/.test(node.resolved) |
| 362 | } |
| 363 | |
| 364 | // Trusted display identity for human-facing output (the `npm install` |
| 365 | // blocked-scripts summary and `npm approve-scripts --allow-scripts-pending`). |