git.stella-ops.org/docs/modules/scanner/operations/entrypoint-lang-node.md

Entry-Point Runtime — Node.js

Signals to gather

• argv0 equals node, nodejs, or path ends with /bin/node.
• Scripts launched via package runners (npm, yarn, pnpm node …, npx).
• Presence of package.json with "main" or "scripts":{"start":…} entries.
• NODE_ENV, NODE_OPTIONS, or NPM_PACKAGE_NAME environment hints.
• Bundler/PM2 scenarios: pm2-runtime, pm2-docker, forever, nodemon.

Implementation notes

• Resolve script arguments (e.g., node server.js) relative to the working dir.
• If invoked through npm start/yarn run, parse package.json to expand the actual script.
• Support TypeScript loaders (ts-node, node --loader, .mjs) by inspecting extensions and flags.
• Normalise shebang-based Node scripts (ShellFlow ensures #!/usr/bin/env node collapses to Node).

Evidence & scoring

• Boost confidence when a concrete JS/TS entry file exists.
• Add evidence for package.json metadata, PM2 ecosystem files, or NODE_ENV values.
• Penalise when the entry file is missing or only package runners are present without scripts.

Edge cases

• Multi-service supervisors (e.g., pm2 managing multiple apps): treat as Supervisor and list programmes as children.
• Serverless shims (e.g., Google Functions) wrap Node; prefer the user-provided handler script if detectable.
• Distroless snapshots may omit package managers; rely on Node binary + script presence.