@aikidosec/safe-chain 1.3.3 → 1.3.4

package/README.md

@@ -33,8 +33,6 @@ Aikido Safe Chain supports the following package managers:
 
 Installing the Aikido Safe Chain is easy with our one-line installer.
 
-> ⚠️ **Already installed via npm?** See the [migration guide](https://github.com/AikidoSec/safe-chain/blob/main/docs/npm-to-binary-migration.md) to switch to the binary version.
-
 ### Unix/Linux/macOS
 
 ```shell
@@ -71,7 +69,20 @@ You can find all available versions on the [releases page](https://github.com/Ai
 
    - This step is crucial as it ensures that the shell aliases for npm, npx, yarn, pnpm, pnpx, bun, bunx, pip, pip3, poetry, uv and pipx are loaded correctly. If you do not restart your terminal, the aliases will not be available.
 
-2. **Verify the installation** by running one of the following commands:
+2. **Verify the installation** by running the verification command:
+
+   ```shell
+   npm safe-chain-verify
+   pnpm safe-chain-verify
+   pip safe-chain-verify
+   uv safe-chain-verify
+
+   # Any other supported package manager: {packagemanager} safe-chain-verify
+   ```
+
+   - The output should display "OK: Safe-chain works!" confirming that Aikido Safe Chain is properly installed and running.
+
+3. **(Optional) Test malware blocking** by attempting to install a test package:
 
    For JavaScript/Node.js:
 
@@ -188,9 +199,14 @@ You can set the minimum package age through multiple sources (in order of priori
    }
    ```
 
-## Custom NPM Registries
+## Custom Registries
+
+Configure Safe Chain to scan packages from custom or private registries.
+
+Supported ecosystems:
 
-Configure Safe Chain to scan packages from custom or private npm registries.
+- Node.js
+- Python
 
 ### Configuration Options
 
@@ -200,6 +216,7 @@ You can set custom registries through environment variable or config file. Both
 
    ```shell
    export SAFE_CHAIN_NPM_CUSTOM_REGISTRIES="npm.company.com,registry.internal.net"
+   export SAFE_CHAIN_PIP_CUSTOM_REGISTRIES="pip.company.com,registry.internal.net"
    ```
 
 2. **Config File** (`~/.aikido/config.json`):
@@ -208,6 +225,9 @@ You can set custom registries through environment variable or config file. Both
    {
      "npm": {
        "customRegistries": ["npm.company.com", "registry.internal.net"]
+     },
+     "pip": {
+       "customRegistries": ["pip.company.com", "registry.internal.net"]
      }
    }
    ```
@@ -237,6 +257,7 @@ iex "& { $(iwr 'https://github.com/AikidoSec/safe-chain/releases/latest/download
 - ✅ **GitHub Actions**
 - ✅ **Azure Pipelines**
 - ✅ **CircleCI**
+- ✅ **Jenkins**
 
 ## GitHub Actions Example
 
@@ -288,4 +309,42 @@ workflows:
       - build
 ```
 
+## Jenkins Example
+
+Note: This assumes Node.js and npm are installed on the Jenkins agent.
+
+```groovy
+pipeline {
+  agent any
+
+  environment {
+    // Jenkins does not automatically persist PATH updates from setup-ci,
+    // so add the shims + binary directory explicitly for all stages.
+    PATH = "${env.HOME}/.safe-chain/shims:${env.HOME}/.safe-chain/bin:${env.PATH}"
+  }
+
+  stages {
+    stage('Install safe-chain') {
+      steps {
+        sh '''
+          set -euo pipefail
+
+          # Install Safe Chain for CI
+          curl -fsSL https://github.com/AikidoSec/safe-chain/releases/latest/download/install-safe-chain.sh | sh -s -- --ci
+        '''
+      }
+    }
+
+    stage('Install project dependencies etc...') {
+      steps {
+        sh '''
+          set -euo pipefail
+          npm ci
+        '''
+      }
+    }
+  }
+}
+```
+
 After setup, all subsequent package manager commands in your CI pipeline will automatically be protected by Aikido Safe Chain's malware detection.

package/bin/safe-chain.js

@@ -3,7 +3,10 @@
 import chalk from "chalk";
 import { ui } from "../src/environment/userInteraction.js";
 import { setup } from "../src/shell-integration/setup.js";
-import { teardown, teardownDirectories } from "../src/shell-integration/teardown.js";
+import {
+  teardown,
+  teardownDirectories,
+} from "../src/shell-integration/teardown.js";
 import { setupCi } from "../src/shell-integration/setup-ci.js";
 import { initializeCliArguments } from "../src/config/cliArguments.js";
 import { setEcoSystem } from "../src/config/settings.js";
@@ -45,7 +48,7 @@ if (tool) {
   const args = process.argv.slice(3);
 
   setEcoSystem(tool.ecoSystem);
-  
+
   // Provide tool context to PM (pip uses this; others ignore)
   const toolContext = { tool: tool.tool, args };
   initializePackageManager(tool.internalPackageManagerName, toolContext);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aikidosec/safe-chain",
-  "version": "1.3.3",
+  "version": "1.3.4",
   "scripts": {
     "test": "node --test --experimental-test-module-mocks 'src/**/*.spec.js'",
     "test:watch": "node --test --watch --experimental-test-module-mocks 'src/**/*.spec.js'",

package/src/config/configFile.js

@@ -11,6 +11,7 @@ import { getEcoSystem } from "./settings.js";
  * @property {unknown | Number} scanTimeout
  * @property {unknown | Number} minimumPackageAgeHours
  * @property {unknown | SafeChainRegistryConfiguration} npm
+ * @property {unknown | SafeChainRegistryConfiguration} pip
  *
  * @typedef {Object} SafeChainRegistryConfiguration
  * We cannot trust the input and should add the necessary validations.
@@ -104,6 +105,28 @@ export function getNpmCustomRegistries() {
   return customRegistries.filter((item) => typeof item === "string");
 }
 
+/**
+ * Gets the custom npm registries from the config file (format parsing only, no validation)
+ * @returns {string[]}
+ */
+export function getPipCustomRegistries() {
+  const config = readConfigFile();
+
+  if (!config || !config.pip) {
+    return [];
+  }
+
+  // TypeScript needs help understanding that config.pip exists and has customRegistries
+  const pipConfig = /** @type {SafeChainRegistryConfiguration} */ (config.pip);
+  const customRegistries = pipConfig.customRegistries;
+
+  if (!Array.isArray(customRegistries)) {
+    return [];
+  }
+
+  return customRegistries.filter((item) => typeof item === "string");
+}
+
 /**
  * @param {import("../api/aikido.js").MalwarePackage[]} data
  * @param {string | number} version
@@ -169,6 +192,9 @@ function readConfigFile() {
     npm: {
       customRegistries: undefined,
     },
+    pip: {
+      customRegistries: undefined,
+    },
   };
 
   const configFilePath = getConfigFilePath();

package/src/config/environmentVariables.js

@@ -15,3 +15,13 @@ export function getMinimumPackageAgeHours() {
 export function getNpmCustomRegistries() {
   return process.env.SAFE_CHAIN_NPM_CUSTOM_REGISTRIES;
 }
+
+/**
+ * Gets the custom pip registries from environment variable
+ * Expected format: comma-separated list of registry domains
+ * Example: "pip.company.com,registry.internal.net"
+ * @returns {string | undefined}
+ */
+export function getPipCustomRegistries() {
+  return process.env.SAFE_CHAIN_PIP_CUSTOM_REGISTRIES;
+}

package/src/config/settings.js

@@ -143,3 +143,21 @@ export function getNpmCustomRegistries() {
   // Normalize each registry (remove protocol if any)
   return uniqueRegistries.map(normalizeRegistry);
 }
+
+/**
+ * Gets the custom npm registries from both environment variable and config file (merged)
+ * @returns {string[]}
+ */
+export function getPipCustomRegistries() {
+  const envRegistries = parseRegistriesFromEnv(
+    environmentVariables.getPipCustomRegistries()
+  );
+  const configRegistries = configFile.getPipCustomRegistries();
+
+  // Merge both sources and remove duplicates
+  const allRegistries = [...envRegistries, ...configRegistries];
+  const uniqueRegistries = [...new Set(allRegistries)];
+
+  // Normalize each registry (remove protocol if any)
+  return uniqueRegistries.map(normalizeRegistry);
+}

package/src/main.js

@@ -13,6 +13,10 @@ import { getAuditStats } from "./scanning/audit/index.js";
  * @returns {Promise<number>}
  */
 export async function main(args) {
+  if (isSafeChainVerify(args)) {
+    return 0;
+  }
+
   process.on("SIGINT", handleProcessTermination);
   process.on("SIGTERM", handleProcessTermination);
 
@@ -104,3 +108,12 @@ export async function main(args) {
 function handleProcessTermination() {
   ui.writeBufferedLogsAndStopBuffering();
 }
+
+/** @param {string[]} args  */
+function isSafeChainVerify(args) {
+  const safeChainCheckCommand = "safe-chain-verify";
+  if (args.length > 0 && args[0] === safeChainCheckCommand) {
+    ui.writeInformation("OK: Safe-chain works!");
+    return true;
+  }
+}

package/src/registryProxy/interceptors/pipInterceptor.js

@@ -1,3 +1,4 @@
+import { getPipCustomRegistries } from "../../config/settings.js";
 import { isMalwarePackage } from "../../scanning/audit/index.js";
 import { interceptRequests } from "./interceptorBuilder.js";
 
@@ -13,7 +14,9 @@ const knownPipRegistries = [
  * @returns {import("./interceptorBuilder.js").Interceptor | undefined}
  */
 export function pipInterceptorForUrl(url) {
-  const registry = knownPipRegistries.find((reg) => url.includes(reg));
+  const customRegistries = getPipCustomRegistries();
+  const registries = [...knownPipRegistries, ...customRegistries];
+  const registry = registries.find((reg) => url.includes(reg));
 
   if (registry) {
     return buildPipInterceptor(registry);
@@ -37,8 +40,8 @@ function buildPipInterceptor(registry) {
     // Per python, packages that differ only by hyphen vs underscore are considered the same.
     const hyphenName = packageName?.includes("_") ? packageName.replace(/_/g, "-") : packageName;
 
-    const isMalicious = 
-       await isMalwarePackage(packageName, version) 
+    const isMalicious =
+       await isMalwarePackage(packageName, version)
     || await isMalwarePackage(hyphenName, version);
 
     if (isMalicious) {

package/src/registryProxy/mitmRequestHandler.js

@@ -15,7 +15,7 @@ import { gunzipSync, gzipSync } from "zlib";
  */
 export function mitmConnect(req, clientSocket, interceptor) {
   ui.writeVerbose(`Safe-chain: Set up MITM tunnel for ${req.url}`);
-  const { hostname } = new URL(`http://${req.url}`);
+  const { hostname, port } = new URL(`http://${req.url}`);
 
   clientSocket.on("error", (err) => {
     ui.writeVerbose(
@@ -26,7 +26,7 @@ export function mitmConnect(req, clientSocket, interceptor) {
     // Not subscribing to 'close' event will cause node to throw and crash.
   });
 
-  const server = createHttpsServer(hostname, interceptor);
+  const server = createHttpsServer(hostname, port, interceptor);
 
   server.on("error", (err) => {
     ui.writeError(`Safe-chain: HTTPS server error: ${err.message}`);
@@ -46,10 +46,11 @@ export function mitmConnect(req, clientSocket, interceptor) {
 
 /**
  * @param {string} hostname
+ * @param {string} port
  * @param {Interceptor} interceptor
  * @returns {import("https").Server}
  */
-function createHttpsServer(hostname, interceptor) {
+function createHttpsServer(hostname, port, interceptor) {
   const cert = generateCertForHost(hostname);
 
   /**
@@ -80,7 +81,7 @@ function createHttpsServer(hostname, interceptor) {
     }
 
     // Collect request body
-    forwardRequest(req, hostname, res, requestInterceptor);
+    forwardRequest(req, hostname, port, res, requestInterceptor);
   }
 
   const server = https.createServer(
@@ -109,11 +110,12 @@ function getRequestPathAndQuery(url) {
 /**
  * @param {import("http").IncomingMessage} req
  * @param {string} hostname
+ * @param {string} port
  * @param {import("http").ServerResponse} res
  * @param {import("./interceptors/interceptorBuilder.js").RequestInterceptionHandler} requestHandler
  */
-function forwardRequest(req, hostname, res, requestHandler) {
-  const proxyReq = createProxyRequest(hostname, req, res, requestHandler);
+function forwardRequest(req, hostname, port, res, requestHandler) {
+  const proxyReq = createProxyRequest(hostname, port, req, res, requestHandler);
 
   proxyReq.on("error", (err) => {
     ui.writeVerbose(
@@ -144,13 +146,14 @@ function forwardRequest(req, hostname, res, requestHandler) {
 
 /**
  * @param {string} hostname
+ * @param {string} port
  * @param {import("http").IncomingMessage} req
  * @param {import("http").ServerResponse} res
  * @param {import("./interceptors/interceptorBuilder.js").RequestInterceptionHandler} requestHandler
  *
  * @returns {import("http").ClientRequest}
  */
-function createProxyRequest(hostname, req, res, requestHandler) {
+function createProxyRequest(hostname, port, req, res, requestHandler) {
   /** @type {NodeJS.Dict<string | string[]> | undefined} */
   let headers = { ...req.headers };
   // Remove the host header from the incoming request before forwarding.
@@ -163,7 +166,7 @@ function createProxyRequest(hostname, req, res, requestHandler) {
   /** @type {import("http").RequestOptions} */
   const options = {
     hostname: hostname,
-    port: 443,
+    port: port || 443,
     path: req.url,
     method: req.method,
     headers: { ...headers },