Entry-Point Runtime — Node.js

Heuristics the Stella Ops scanner uses to classify a container entry point as a Node.js application — direct script launch, package-runner invocation, or a process manager such as PM2 — plus the evidence it attaches and the edge cases it guards against. For the shared detector contracts, scoring, and calibration, see the Runtime Detector Overview.

Signals to gather

• argv0 equals node, nodejs, or path ends with /bin/node.
• Scripts launched via package runners (npm, yarn, pnpm node …, npx).
• Presence of package.json with "main" or "scripts":{"start":…} entries.
• NODE_ENV, NODE_OPTIONS, or NPM_PACKAGE_NAME environment hints.
• Bundler/PM2 scenarios: pm2-runtime, pm2-docker, forever, nodemon.

Implementation notes

• Resolve script arguments (e.g., node server.js) relative to the working dir.
• If invoked through npm start/yarn run, parse package.json to expand the actual script.
• Support TypeScript loaders (ts-node, node --loader, .mjs) by inspecting extensions and flags.
• Normalise shebang-based Node scripts (ShellFlow ensures #!/usr/bin/env node collapses to Node).

Evidence & scoring

• Boost confidence when a concrete JS/TS entry file exists.
• Add evidence for package.json metadata, PM2 ecosystem files, or NODE_ENV values.
• Penalise when the entry file is missing or only package runners are present without scripts.

Edge cases

• Multi-service supervisors (e.g., pm2 managing multiple apps): treat as Supervisor and list the managed programs as children.
• Serverless shims (e.g., Google Functions) wrap Node; prefer the user-provided handler script if detectable.
• Distroless snapshots may omit package managers; rely on the Node binary plus script presence.

Related

• Runtime Detector Overview — shared contracts, scoring, calibration.
• Entry-Point Runtime — Deno — the closest sibling runtime.
• Supervisor detector — PM2 and other multi-app process managers.