feat: Verify npm tokens against custom registry URLs from .npmrc context

[jainlakshya]

Summary
Implements #1455 - Modified npm token detectors (v1 and v2) to extract and verify against custom registry URLs when found in .npmrc format, instead of always verifying against registry.npmjs.org.

Motivation
Enterprise environments often use private npm registries (Nexus, Artifactory, JFrog, etc.) instead of the public registry.npmjs.org. Previously, valid tokens for these registries were incorrectly marked as unverified because TruffleHog only checked against registry.npmjs.org.

Changes

• Added regex pattern to extract registry URLs from .npmrc format: //registry-url/:_authToken=token
• Modified verification logic to try extracted registries first
• Falls back to registry.npmjs.org if no custom registry found in context
• Added registry URL to AnalysisInfo when token is successfully verified
• Added comprehensive unit tests for URL extraction and building

Supported Formats
The detectors now recognize and verify tokens in .npmrc format:

//artifactory.example.com/:_authToken=3aAcac6c-9847-23d9-ce65-917590b81cf0
//nexus.example.com/repository/npm-proxy/:_authToken=npm_hK0FJXBYCkejhEMY4Kp6bOOZn1DlfBOmtbJY

Technical Details

• Regex pattern: //([^/:]+(?:/[^/:])?)/:_authToken\s*=\s*[^\s]+
• Supports registries with paths (e.g., nexus.example.com/repository/npm-proxy)
• Handles both http:// and https:// prefixes
• Deduplicates multiple occurrences of the same registry
• Verification tries all found registries before falling back to default

Testing

• All existing tests pass
• Added 10 new unit tests covering:
  • Registry URL extraction from various formats
  • URL building with different schemes and paths
  • Multiple registries in same context
  • Fallback to default registry

Breaking Changes
None. This is backward compatible - tokens without registry context still verify against registry.npmjs.org as before.

Checklist

• Added tests for new functionality
• All tests pass
• Backward compatible
• No breaking changes

---

Note

Medium Risk
Changes verification network targets for npmtoken/npmtokenv2 by deriving registry hosts from scanned content, which could affect outbound request behavior and verification accuracy (mitigated by the no-local-address HTTP client).

Overview
NPM token detectors (v1 and v2) now parse .npmrc-style lines (//<registry>/:_authToken=<token>) to infer a registry host/path for each discovered token and verify against that registry’s /-/whoami endpoint, falling back to registry.npmjs.org when no context is found.

Verification logic was refactored into helpers (extractTokenRegistryPairs, buildRegistryURL, verifyToken), switched to detectors.DetectorHttpClientWithNoLocalAddresses, and successful verifications now record the registry in AnalysisInfo. Extensive unit tests were added for registry extraction and URL building in both detectors.

^{Reviewed by Cursor Bugbot for commit 817e5e2. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Reviewed by Cursor Bugbot for commit 6c19b86. Configure here.}