@aikidosec/safe-chain 1.1.0 → 1.1.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/README.md +13 -16
  2. package/docs/shell-integration.md +4 -4
  3. package/package.json +2 -2
  4. package/src/registryProxy/tunnelRequestHandler.js +15 -5
package/README.md CHANGED
@@ -1,23 +1,20 @@
1
1
  # Aikido Safe Chain
2
2
 
3
- The Aikido Safe Chain **prevents developers from installing malware** on their workstations through npm, npx, yarn, pnpm and pnpx. It's **free** to use and does not require any token.
3
+ The Aikido Safe Chain **prevents developers from installing malware** on their workstations through npm, npx, yarn, pnpm, pnpx, bun, and bunx. It's **free** to use and does not require any token.
4
4
 
5
- The Aikido Safe Chain wraps around the [npm cli](https://github.com/npm/cli), [npx](https://github.com/npm/cli/blob/latest/docs/content/commands/npx.md), [yarn](https://yarnpkg.com/), [pnpm](https://pnpm.io/), and [pnpx](https://pnpm.io/cli/dlx) to provide extra checks before installing new packages. This tool will detect when a package contains malware and prompt you to exit, preventing npm, npx, yarn, pnpm or pnpx from downloading or running the malware.
5
+ The Aikido Safe Chain wraps around the [npm cli](https://github.com/npm/cli), [npx](https://github.com/npm/cli/blob/latest/docs/content/commands/npx.md), [yarn](https://yarnpkg.com/), [pnpm](https://pnpm.io/), [pnpx](https://pnpm.io/cli/dlx), [bun](https://bun.sh/), and [bunx](https://bun.sh/docs/cli/bunx) to provide extra checks before installing new packages. This tool will detect when a package contains malware and prompt you to exit, preventing npm, npx, yarn, pnpm, pnpx, bun, or bunx from downloading or running the malware.
6
6
 
7
7
  ![demo](./docs/safe-package-manager-demo.png)
8
8
 
9
9
  Aikido Safe Chain works on Node.js version 18 and above and supports the following package managers:
10
10
 
11
- - ✅ full coverage: **npm >= 10.4.0**:
12
- - ⚠️ limited to scanning the install command arguments (broader scanning coming soon):
13
- - **npm < 10.4.0**
14
- - **npx**
15
- - **yarn**
16
- - **pnpm**
17
- - **pnpx**
18
- - 🚧 **bun**: coming soon
19
-
20
- Note on the limited support for npm < 10.4.0, npx, yarn, pnpm and pnpx: adding **full support for these package managers is a high priority**. In the meantime, we offer limited support already, which means that the Aikido Safe Chain will scan the package names passed as arguments to the install commands. However, it will not scan the full dependency tree of these packages.
11
+ - ✅ **npm**
12
+ - ✅ **npx**
13
+ - ✅ **yarn**
14
+ - ✅ **pnpm**
15
+ - ✅ **pnpx**
16
+ - ✅ **bun**
17
+ - ✅ **bunx**
21
18
 
22
19
  # Usage
23
20
 
@@ -34,20 +31,20 @@ Installing the Aikido Safe Chain is easy. You just need 3 simple steps:
34
31
  safe-chain setup
35
32
  ```
36
33
  3. **❗Restart your terminal** to start using the Aikido Safe Chain.
37
- - This step is crucial as it ensures that the shell aliases for npm, npx, yarn, pnpm and pnpx are loaded correctly. If you do not restart your terminal, the aliases will not be available.
34
+ - This step is crucial as it ensures that the shell aliases for npm, npx, yarn, pnpm, pnpx, bun, and bunx are loaded correctly. If you do not restart your terminal, the aliases will not be available.
38
35
  4. **Verify the installation** by running:
39
36
  ```shell
40
37
  npm install safe-chain-test
41
38
  ```
42
39
  - The output should show that Aikido Safe Chain is blocking the installation of this package as it is flagged as malware.
43
40
 
44
- When running `npm`, `npx`, `yarn`, `pnpm` or `pnpx` commands, the Aikido Safe Chain will automatically check for malware in the packages you are trying to install. If any malware is detected, it will prompt you to exit the command.
41
+ When running `npm`, `npx`, `yarn`, `pnpm`, `pnpx`, `bun`, or `bunx` commands, the Aikido Safe Chain will automatically check for malware in the packages you are trying to install. If any malware is detected, it will prompt you to exit the command.
45
42
 
46
43
  ## How it works
47
44
 
48
- The Aikido Safe Chain works by intercepting the npm, npx, yarn, pnpm and pnpx commands and verifying the packages against **[Aikido Intel - Open Sources Threat Intelligence](https://intel.aikido.dev/?tab=malware)**.
45
+ The Aikido Safe Chain works by running a lightweight proxy server that intercepts package downloads from the npm registry. When you run npm, npx, yarn, pnpm, pnpx, bun, or bunx commands, all package downloads are routed through this local proxy, which verifies packages in real-time against **[Aikido Intel - Open Sources Threat Intelligence](https://intel.aikido.dev/?tab=malware)**. If malware is detected in any package (including deep dependencies), the proxy blocks the download before the malicious code reaches your machine.
49
46
 
50
- The Aikido Safe Chain integrates with your shell to provide a seamless experience when using npm, npx, yarn, pnpm and pnpx commands. It sets up aliases for these commands so that they are wrapped by the Aikido Safe Chain commands, which perform malware checks before executing the original commands. We currently support:
47
+ The Aikido Safe Chain integrates with your shell to provide a seamless experience when using npm, npx, yarn, pnpm, pnpx, bun, and bunx commands. It sets up aliases for these commands so that they are wrapped by the Aikido Safe Chain commands, which manage the proxy server before executing the original commands. We currently support:
51
48
 
52
49
  - ✅ **Bash**
53
50
  - ✅ **Zsh**
package/docs/shell-integration.md CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  ## Overview
4
4
 
5
- The shell integration automatically wraps common package manager commands (`npm`, `npx`, `yarn`, `pnpm`, `pnpx`) with Aikido's security scanning functionality. This is achieved by sourcing startup scripts that define shell functions to wrap these commands with their Aikido-protected equivalents.
5
+ The shell integration automatically wraps common package manager commands (`npm`, `npx`, `yarn`, `pnpm`, `pnpx`, `bun`, `bunx`) with Aikido's security scanning functionality. This is achieved by sourcing startup scripts that define shell functions to wrap these commands with their Aikido-protected equivalents.
6
6
 
7
7
  ## Supported Shells
8
8
 
@@ -28,7 +28,7 @@ This command:
28
28
 
29
29
  - Copies necessary startup scripts to Safe Chain's installation directory (`~/.safe-chain/scripts`)
30
30
  - Detects all supported shells on your system
31
- - Sources each shell's startup file to add Safe Chain functions for `npm`, `npx`, `yarn`, `pnpm`, and `pnpx`
31
+ - Sources each shell's startup file to add Safe Chain functions for `npm`, `npx`, `yarn`, `pnpm`, `pnpx`, `bun`, and `bunx`
32
32
 
33
33
  ❗ After running this command, **you must restart your terminal** for the changes to take effect. This ensures that the startup scripts are sourced correctly.
34
34
 
@@ -77,7 +77,7 @@ The system modifies the following files to source Safe Chain startup scripts:
77
77
  This means the shell functions are working but the Aikido commands aren't installed or available in your PATH:
78
78
 
79
79
  - Make sure Aikido Safe Chain is properly installed on your system
80
- - Verify the `aikido-npm`, `aikido-npx`, `aikido-yarn`, `aikido-pnpm` and `aikido-pnpx` commands exist
80
+ - Verify the `aikido-npm`, `aikido-npx`, `aikido-yarn`, `aikido-pnpm`, `aikido-pnpx`, `aikido-bun`, and `aikido-bunx` commands exist
81
81
  - Check that these commands are in your system's PATH
82
82
 
83
83
  ### Manual Verification
@@ -120,4 +120,4 @@ npm() {
120
120
  }
121
121
  ```
122
122
 
123
- Repeat this pattern for `npx`, `yarn`, `pnpm`, and `pnpx` using their respective `aikido-*` commands. After adding these functions, restart your terminal to apply the changes.
123
+ Repeat this pattern for `npx`, `yarn`, `pnpm`, `pnpx`, `bun`, and `bunx` using their respective `aikido-*` commands. After adding these functions, restart your terminal to apply the changes.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@aikidosec/safe-chain",
3
- "version": "1.1.0",
3
+ "version": "1.1.2",
4
4
  "scripts": {
5
5
  "test": "node --test --experimental-test-module-mocks 'src/**/*.spec.js'",
6
6
  "test:watch": "node --test --watch --experimental-test-module-mocks 'src/**/*.spec.js'",
@@ -28,7 +28,7 @@
28
28
  "keywords": [],
29
29
  "author": "Aikido Security",
30
30
  "license": "AGPL-3.0-or-later",
31
- "description": "The Aikido Safe Chain wraps around the [npm cli](https://github.com/npm/cli), [npx](https://github.com/npm/cli/blob/latest/docs/content/commands/npx.md), [yarn](https://yarnpkg.com/), [pnpm](https://pnpm.io/), and [pnpx](https://pnpm.io/cli/dlx) to provide extra checks before installing new packages. This tool will detect when a package contains malware and prompt you to exit, preventing npm, npx, yarn, pnpm, or pnpx from downloading or running the malware.",
31
+ "description": "The Aikido Safe Chain wraps around the [npm cli](https://github.com/npm/cli), [npx](https://github.com/npm/cli/blob/latest/docs/content/commands/npx.md), [yarn](https://yarnpkg.com/), [pnpm](https://pnpm.io/), [pnpx](https://pnpm.io/cli/dlx), [bun](https://bun.sh/), and [bunx](https://bun.sh/docs/cli/bunx) to provide extra checks before installing new packages. This tool will detect when a package contains malware and prompt you to exit, preventing npm, npx, yarn, pnpm, pnpx, bun, or bunx from downloading or running the malware.",
32
32
  "dependencies": {
33
33
  "abbrev": "3.0.1",
34
34
  "chalk": "5.4.1",
package/src/registryProxy/tunnelRequestHandler.js CHANGED
@@ -35,7 +35,9 @@ function tunnelRequestToDestination(req, clientSocket, head) {
35
35
  ui.writeError(
36
36
  `Safe-chain: error connecting to ${hostname}:${port} - ${err.message}`
37
37
  );
38
- clientSocket.end("HTTP/1.1 502 Bad Gateway\r\n\r\n");
38
+ if (clientSocket.writable) {
39
+ clientSocket.end("HTTP/1.1 502 Bad Gateway\r\n\r\n");
40
+ }
39
41
  });
40
42
  }
41
43
 
@@ -76,8 +78,12 @@ function tunnelRequestViaProxy(req, clientSocket, head, proxyUrl) {
76
78
  ui.writeError(
77
79
  `Safe-chain: proxy CONNECT failed: ${response.split("\r\n")[0]}`
78
80
  );
79
- clientSocket.end("HTTP/1.1 502 Bad Gateway\r\n\r\n");
80
- proxySocket.end();
81
+ if (clientSocket.writable) {
82
+ clientSocket.end("HTTP/1.1 502 Bad Gateway\r\n\r\n");
83
+ }
84
+ if (proxySocket.writable) {
85
+ proxySocket.end();
86
+ }
81
87
  }
82
88
  });
83
89
 
@@ -88,11 +94,15 @@ function tunnelRequestViaProxy(req, clientSocket, head, proxyUrl) {
88
94
  proxy.port || 8080
89
95
  } - ${err.message}`
90
96
  );
91
- clientSocket.end("HTTP/1.1 502 Bad Gateway\r\n\r\n");
97
+ if (clientSocket.writable) {
98
+ clientSocket.end("HTTP/1.1 502 Bad Gateway\r\n\r\n");
99
+ }
92
100
  }
93
101
  });
94
102
 
95
103
  clientSocket.on("error", () => {
96
- proxySocket.end();
104
+ if (proxySocket.writable) {
105
+ proxySocket.end();
106
+ }
97
107
  });
98
108
  }