Errors parsing yarn.lock files with quoted properties

[spencerschrock]

Scorecard currently calls DoScan here when checking for vulns. When we scan public repos, we sometimes encounter yarn.lock files that write hundred of lines to os.Stderr due to the issue discussed in #102 and #142.

Here are a few of the offending files that we've encountered:
https://github.com/Glissir/react-trello/blob/565dd41fd2263787412b6e131c9f21b26c7204cd/yarn.lock
https://github.com/nodeWechat/wechat4u/blob/93972863435ba0cfe98c316bbe6b739da390897d/yarn.lock

#102 mentioned being unable to reproduced with yarn, but a few search results have mentioned the issue is caused when npm manipulates the yarn.lock file:

npm/cli#5126

https://stackoverflow.com/q/74272832
https://bstefanski.com/upgrading-one-dependency-causes-whole-yarnlock-change-fix

[andrewpollock]

Drive-by observation: from reading https://bstefanski.com/upgrading-one-dependency-causes-whole-yarnlock-change-fix something is very wrong with a tool that makes unnecessary wholesale changes to the file like that. Makes reviewing changes unnecessarily onerous and provides an easy opportunity for a bad actor to slip in something under the reviewer's radar...

From a quick search, this sounds like yarnpkg/yarn#4953, which has been open for a concerning amount of time...

[G-Rath]

Ok it looks like this is because npm v7+ formats yarn.lock in a technically valid but slightly different way to yarn v1 (I swear I tested that when I wrote the parser originally, but I guess not 🤷) - so long as you use the same tool, you shouldn't see huge diffs, it's only if you switch between npm and yarn that the lockfile will change dramatically.

I've created #250 to fix this