[ushpraise]

Summary

Implements the four behavioral-analysis issues in one scoped change.

• [behavioral] Safely download and unpack npm tarballs for analysis #100 — safe npm tarballs (src/behavioral/tarball.rs): downloads dist.tarball through the polite client, verifies dist.integrity as SHA-512 SRI, and unpacks in memory. 50 MB body/unpacked caps, 10k file cap, path-length cap; rejects absolute paths, .., backslashes, drive prefixes, NUL/non-UTF-8 paths, duplicates, symlinks, hard links and all other non-file entries. Nothing is executed.
• [behavioral] Flag npm install scripts in package.json #99 — install scripts (src/behavioral/scripts.rs): install_scripts(package_json) -> Vec<(String, String)> returns preinstall, install, postinstall and prepare; each is wrapped as a medium-severity InstallScript finding on package.json.
• [behavioral] Heuristics for obfuscated JavaScript #101 — obfuscated JavaScript (src/behavioral/obfuscation.rs): scores base64/hex blobs >200 chars, eval(/new Function(/atob(, high-entropy long literals and very long lines. Threshold is 4 (documented), so a minified-but-benign file is not flagged. Adds scan_tree for .js/.mjs/.cjs.
• [behavioral] Detect network and credential access in install scripts #102 — install-script network/credentials (src/behavioral/network.rs): flags curl/wget piped to a shell, HTTP(S) requests to raw IPv4s, and reads of npm/AWS/GitHub tokens, ~/.ssh and ~/.npmrc. Includes a truncated snippet and follows local files invoked by lifecycle scripts without escaping the package root.
• Wired behavioral into lib.rs, updated PROGRESS.md, and documented the new severities in docs/severity.md.

Tests

• cargo test -p deprader --lib --locked — 224 passed, 0 failed (63 of them in behavioral, including crafted malicious tar.gz archives: traversal, absolute/Windows paths, symlink, hard link, size bomb, file-count cap, duplicates; tarball integrity; install-script combinations; minified-benign vs obfuscated JS; one network test per pattern plus a benign build script).
• cargo clippy -p deprader --lib --locked -- -D warnings — pass.
• cargo fmt -p deprader -- --check — pass.
• git diff --check — pass.

Pre-existing workspace blockers

cargo test --workspace and cargo clippy --workspace --all-targets do not compile on the base commit d50acb2 (whose CI is already red). The failures are outside this change and were left untouched to keep the PR scoped:

• contracts/deprader_router/src/lib.rs calls Self::is_paused / Error::Paused without definitions (merged pause feature lost its helpers), and the contract test imports a wasm file CI has not built.
• src/bin/depradar.rs references watch_packages / FakeCrawler without imports and lacks a Command::Watch match arm.

These need a separate fix on main; this PR's library target builds and tests cleanly.

Closes #100
Closes #99
Closes #101
Closes #102

[drips-wave]

@ushpraise Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits