@nodesecure/scanner 3.1.0 → 3.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +2 -2
- package/index.js +63 -63
- package/package.json +86 -86
- package/src/depWalker.js +310 -304
- package/src/tarball.js +173 -173
- package/src/utils/warnings.js +10 -0
- package/types/api.d.ts +15 -15
- package/types/scanner.d.ts +1 -1
package/README.md
CHANGED
|
@@ -49,9 +49,9 @@ await Promise.allSettled(promises);
|
|
|
49
49
|
See `types/api.d.ts` for a complete TypeScript definition.
|
|
50
50
|
|
|
51
51
|
```ts
|
|
52
|
-
function cwd(
|
|
52
|
+
function cwd(location: string, options?: Scanner.Options): Promise<Scanner.Payload>;
|
|
53
53
|
function from(packageName: string, options?: Scanner.Options): Promise<Scanner.Payload>;
|
|
54
|
-
function verify(packageName
|
|
54
|
+
function verify(packageName?: string | null): Promise<Scanner.VerifyPayload>;
|
|
55
55
|
```
|
|
56
56
|
|
|
57
57
|
`Options` is described with the following TypeScript interface:
|
package/index.js
CHANGED
|
@@ -1,63 +1,63 @@
|
|
|
1
|
-
// Import Node.js Dependencies
|
|
2
|
-
import path from "path";
|
|
3
|
-
import fs from "fs/promises";
|
|
4
|
-
import timers from "timers/promises";
|
|
5
|
-
import os from "os";
|
|
6
|
-
|
|
7
|
-
// Import Third-party Dependencies
|
|
8
|
-
import pacote from "pacote";
|
|
9
|
-
import { getLocalRegistryURL } from "@nodesecure/npm-registry-sdk";
|
|
10
|
-
|
|
11
|
-
// Import Internal Dependencies
|
|
12
|
-
import { depWalker } from "./src/depWalker.js";
|
|
13
|
-
import { NPM_TOKEN } from "./src/utils/index.js";
|
|
14
|
-
import { ScannerLoggerEvents } from "./src/constants.js";
|
|
15
|
-
import Logger from "./src/class/logger.class.js";
|
|
16
|
-
import * as tarball from "./src/tarball.js";
|
|
17
|
-
|
|
18
|
-
// CONSTANTS
|
|
19
|
-
const kDefaultCwdOptions = { forceRootAnalysis: true, usePackageLock: true };
|
|
20
|
-
|
|
21
|
-
export async function cwd(
|
|
22
|
-
const finalizedOptions = Object.assign({}, kDefaultCwdOptions, options);
|
|
23
|
-
|
|
24
|
-
logger.start(ScannerLoggerEvents.manifest.read);
|
|
25
|
-
const packagePath = path.join(
|
|
26
|
-
const str = await fs.readFile(packagePath, "utf-8");
|
|
27
|
-
logger.end(ScannerLoggerEvents.manifest.read);
|
|
28
|
-
|
|
29
|
-
return depWalker(JSON.parse(str), finalizedOptions, logger);
|
|
30
|
-
}
|
|
31
|
-
|
|
32
|
-
export async function from(packageName, options, logger = new Logger()) {
|
|
33
|
-
logger.start(ScannerLoggerEvents.manifest.fetch);
|
|
34
|
-
const manifest = await pacote.manifest(packageName, {
|
|
35
|
-
...NPM_TOKEN, registry: getLocalRegistryURL(), cache: `${os.homedir()}/.npm`
|
|
36
|
-
});
|
|
37
|
-
logger.end(ScannerLoggerEvents.manifest.fetch);
|
|
38
|
-
|
|
39
|
-
return depWalker(manifest, options, logger);
|
|
40
|
-
}
|
|
41
|
-
|
|
42
|
-
export async function verify(packageName = null) {
|
|
43
|
-
if (typeof packageName === "undefined" || packageName === null) {
|
|
44
|
-
return await tarball.scanPackage(process.cwd());
|
|
45
|
-
}
|
|
46
|
-
|
|
47
|
-
const tmpLocation = await fs.mkdtemp(path.join(os.tmpdir(), "/"));
|
|
48
|
-
const dest = path.join(tmpLocation, packageName);
|
|
49
|
-
|
|
50
|
-
try {
|
|
51
|
-
await pacote.extract(packageName, dest, {
|
|
52
|
-
...NPM_TOKEN, registry: getLocalRegistryURL(), cache: `${os.homedir()}/.npm`
|
|
53
|
-
});
|
|
54
|
-
|
|
55
|
-
return await tarball.scanPackage(dest, packageName);
|
|
56
|
-
}
|
|
57
|
-
finally {
|
|
58
|
-
await timers.setImmediate();
|
|
59
|
-
await fs.rm(tmpLocation, { recursive: true, force: true });
|
|
60
|
-
}
|
|
61
|
-
}
|
|
62
|
-
|
|
63
|
-
export { depWalker, tarball, Logger, ScannerLoggerEvents };
|
|
1
|
+
// Import Node.js Dependencies
|
|
2
|
+
import path from "path";
|
|
3
|
+
import fs from "fs/promises";
|
|
4
|
+
import timers from "timers/promises";
|
|
5
|
+
import os from "os";
|
|
6
|
+
|
|
7
|
+
// Import Third-party Dependencies
|
|
8
|
+
import pacote from "pacote";
|
|
9
|
+
import { getLocalRegistryURL } from "@nodesecure/npm-registry-sdk";
|
|
10
|
+
|
|
11
|
+
// Import Internal Dependencies
|
|
12
|
+
import { depWalker } from "./src/depWalker.js";
|
|
13
|
+
import { NPM_TOKEN } from "./src/utils/index.js";
|
|
14
|
+
import { ScannerLoggerEvents } from "./src/constants.js";
|
|
15
|
+
import Logger from "./src/class/logger.class.js";
|
|
16
|
+
import * as tarball from "./src/tarball.js";
|
|
17
|
+
|
|
18
|
+
// CONSTANTS
|
|
19
|
+
const kDefaultCwdOptions = { forceRootAnalysis: true, usePackageLock: true };
|
|
20
|
+
|
|
21
|
+
export async function cwd(location = process.cwd(), options = {}, logger = new Logger()) {
|
|
22
|
+
const finalizedOptions = Object.assign({ location }, kDefaultCwdOptions, options);
|
|
23
|
+
|
|
24
|
+
logger.start(ScannerLoggerEvents.manifest.read);
|
|
25
|
+
const packagePath = path.join(location, "package.json");
|
|
26
|
+
const str = await fs.readFile(packagePath, "utf-8");
|
|
27
|
+
logger.end(ScannerLoggerEvents.manifest.read);
|
|
28
|
+
|
|
29
|
+
return depWalker(JSON.parse(str), finalizedOptions, logger);
|
|
30
|
+
}
|
|
31
|
+
|
|
32
|
+
export async function from(packageName, options, logger = new Logger()) {
|
|
33
|
+
logger.start(ScannerLoggerEvents.manifest.fetch);
|
|
34
|
+
const manifest = await pacote.manifest(packageName, {
|
|
35
|
+
...NPM_TOKEN, registry: getLocalRegistryURL(), cache: `${os.homedir()}/.npm`
|
|
36
|
+
});
|
|
37
|
+
logger.end(ScannerLoggerEvents.manifest.fetch);
|
|
38
|
+
|
|
39
|
+
return depWalker(manifest, options, logger);
|
|
40
|
+
}
|
|
41
|
+
|
|
42
|
+
export async function verify(packageName = null) {
|
|
43
|
+
if (typeof packageName === "undefined" || packageName === null) {
|
|
44
|
+
return await tarball.scanPackage(process.cwd());
|
|
45
|
+
}
|
|
46
|
+
|
|
47
|
+
const tmpLocation = await fs.mkdtemp(path.join(os.tmpdir(), "/"));
|
|
48
|
+
const dest = path.join(tmpLocation, packageName);
|
|
49
|
+
|
|
50
|
+
try {
|
|
51
|
+
await pacote.extract(packageName, dest, {
|
|
52
|
+
...NPM_TOKEN, registry: getLocalRegistryURL(), cache: `${os.homedir()}/.npm`
|
|
53
|
+
});
|
|
54
|
+
|
|
55
|
+
return await tarball.scanPackage(dest, packageName);
|
|
56
|
+
}
|
|
57
|
+
finally {
|
|
58
|
+
await timers.setImmediate();
|
|
59
|
+
await fs.rm(tmpLocation, { recursive: true, force: true });
|
|
60
|
+
}
|
|
61
|
+
}
|
|
62
|
+
|
|
63
|
+
export { depWalker, tarball, Logger, ScannerLoggerEvents };
|
package/package.json
CHANGED
|
@@ -1,86 +1,86 @@
|
|
|
1
|
-
{
|
|
2
|
-
"name": "@nodesecure/scanner",
|
|
3
|
-
"version": "3.
|
|
4
|
-
"description": "A package API to run a static analysis of your module's dependencies.",
|
|
5
|
-
"exports": "./index.js",
|
|
6
|
-
"engines": {
|
|
7
|
-
"node": ">=16"
|
|
8
|
-
},
|
|
9
|
-
"scripts": {
|
|
10
|
-
"lint": "eslint src test",
|
|
11
|
-
"prepublishOnly": "pkg-ok",
|
|
12
|
-
"test": "npm run lint && npm run test-only",
|
|
13
|
-
"test-only": "cross-env esm-tape-runner 'test/**/*.spec.js' | tap-monkey",
|
|
14
|
-
"coverage": "c8 -r html npm run test-only"
|
|
15
|
-
},
|
|
16
|
-
"files": [
|
|
17
|
-
"src",
|
|
18
|
-
"types",
|
|
19
|
-
"index.js",
|
|
20
|
-
"index.d.ts"
|
|
21
|
-
],
|
|
22
|
-
"repository": {
|
|
23
|
-
"type": "git",
|
|
24
|
-
"url": "git+https://github.com/NodeSecure/scanner.git"
|
|
25
|
-
},
|
|
26
|
-
"keywords": [
|
|
27
|
-
"node",
|
|
28
|
-
"nodejs",
|
|
29
|
-
"security",
|
|
30
|
-
"cli",
|
|
31
|
-
"sast",
|
|
32
|
-
"scanner",
|
|
33
|
-
"static",
|
|
34
|
-
"code",
|
|
35
|
-
"analysis",
|
|
36
|
-
"node_modules",
|
|
37
|
-
"tree",
|
|
38
|
-
"npm",
|
|
39
|
-
"registry",
|
|
40
|
-
"graph",
|
|
41
|
-
"visualization",
|
|
42
|
-
"dependencies"
|
|
43
|
-
],
|
|
44
|
-
"author": "NodeSecure",
|
|
45
|
-
"license": "MIT",
|
|
46
|
-
"bugs": {
|
|
47
|
-
"url": "https://github.com/NodeSecure/scanner/issues"
|
|
48
|
-
},
|
|
49
|
-
"homepage": "https://github.com/NodeSecure/scanner#readme",
|
|
50
|
-
"devDependencies": {
|
|
51
|
-
"@nodesecure/eslint-config": "^1.3.
|
|
52
|
-
"@slimio/is": "^1.5.1",
|
|
53
|
-
"@small-tech/esm-tape-runner": "^1.0.3",
|
|
54
|
-
"@small-tech/tap-monkey": "^1.3.0",
|
|
55
|
-
"@types/node": "^
|
|
56
|
-
"c8": "^7.
|
|
57
|
-
"cross-env": "^7.0.3",
|
|
58
|
-
"dotenv": "^
|
|
59
|
-
"eslint": "^8.
|
|
60
|
-
"get-folder-size": "^3.1.0",
|
|
61
|
-
"pkg-ok": "^2.3.1",
|
|
62
|
-
"sinon": "^12.0.1",
|
|
63
|
-
"snap-shot-core": "^10.2.4",
|
|
64
|
-
"tape": "^5.
|
|
65
|
-
},
|
|
66
|
-
"dependencies": {
|
|
67
|
-
"@nodesecure/flags": "^2.2.0",
|
|
68
|
-
"@nodesecure/fs-walk": "^1.0.0",
|
|
69
|
-
"@nodesecure/i18n": "^1.2.1",
|
|
70
|
-
"@nodesecure/js-x-ray": "^4.2.0",
|
|
71
|
-
"@nodesecure/npm-registry-sdk": "^1.3.0",
|
|
72
|
-
"@nodesecure/ntlp": "^2.1.0",
|
|
73
|
-
"@nodesecure/utils": "^1.0.0",
|
|
74
|
-
"@nodesecure/vuln": "^1.
|
|
75
|
-
"@npm/types": "^1.0.1",
|
|
76
|
-
"@npmcli/arborist": "^4.
|
|
77
|
-
"@slimio/lock": "^1.0.0",
|
|
78
|
-
"builtins": "^4.0.0",
|
|
79
|
-
"combine-async-iterators": "^2.0.1",
|
|
80
|
-
"itertools": "^1.7.1",
|
|
81
|
-
"lodash.difference": "^4.5.0",
|
|
82
|
-
"pacote": "^12.0.
|
|
83
|
-
"semver": "^7.3.4"
|
|
84
|
-
},
|
|
85
|
-
"type": "module"
|
|
86
|
-
}
|
|
1
|
+
{
|
|
2
|
+
"name": "@nodesecure/scanner",
|
|
3
|
+
"version": "3.3.0",
|
|
4
|
+
"description": "A package API to run a static analysis of your module's dependencies.",
|
|
5
|
+
"exports": "./index.js",
|
|
6
|
+
"engines": {
|
|
7
|
+
"node": ">=16"
|
|
8
|
+
},
|
|
9
|
+
"scripts": {
|
|
10
|
+
"lint": "eslint src test",
|
|
11
|
+
"prepublishOnly": "pkg-ok",
|
|
12
|
+
"test": "npm run lint && npm run test-only",
|
|
13
|
+
"test-only": "cross-env esm-tape-runner 'test/**/*.spec.js' | tap-monkey",
|
|
14
|
+
"coverage": "c8 -r html npm run test-only"
|
|
15
|
+
},
|
|
16
|
+
"files": [
|
|
17
|
+
"src",
|
|
18
|
+
"types",
|
|
19
|
+
"index.js",
|
|
20
|
+
"index.d.ts"
|
|
21
|
+
],
|
|
22
|
+
"repository": {
|
|
23
|
+
"type": "git",
|
|
24
|
+
"url": "git+https://github.com/NodeSecure/scanner.git"
|
|
25
|
+
},
|
|
26
|
+
"keywords": [
|
|
27
|
+
"node",
|
|
28
|
+
"nodejs",
|
|
29
|
+
"security",
|
|
30
|
+
"cli",
|
|
31
|
+
"sast",
|
|
32
|
+
"scanner",
|
|
33
|
+
"static",
|
|
34
|
+
"code",
|
|
35
|
+
"analysis",
|
|
36
|
+
"node_modules",
|
|
37
|
+
"tree",
|
|
38
|
+
"npm",
|
|
39
|
+
"registry",
|
|
40
|
+
"graph",
|
|
41
|
+
"visualization",
|
|
42
|
+
"dependencies"
|
|
43
|
+
],
|
|
44
|
+
"author": "NodeSecure",
|
|
45
|
+
"license": "MIT",
|
|
46
|
+
"bugs": {
|
|
47
|
+
"url": "https://github.com/NodeSecure/scanner/issues"
|
|
48
|
+
},
|
|
49
|
+
"homepage": "https://github.com/NodeSecure/scanner#readme",
|
|
50
|
+
"devDependencies": {
|
|
51
|
+
"@nodesecure/eslint-config": "^1.3.1",
|
|
52
|
+
"@slimio/is": "^1.5.1",
|
|
53
|
+
"@small-tech/esm-tape-runner": "^1.0.3",
|
|
54
|
+
"@small-tech/tap-monkey": "^1.3.0",
|
|
55
|
+
"@types/node": "^17.0.13",
|
|
56
|
+
"c8": "^7.11.0",
|
|
57
|
+
"cross-env": "^7.0.3",
|
|
58
|
+
"dotenv": "^14.3.2",
|
|
59
|
+
"eslint": "^8.7.0",
|
|
60
|
+
"get-folder-size": "^3.1.0",
|
|
61
|
+
"pkg-ok": "^2.3.1",
|
|
62
|
+
"sinon": "^12.0.1",
|
|
63
|
+
"snap-shot-core": "^10.2.4",
|
|
64
|
+
"tape": "^5.5.0"
|
|
65
|
+
},
|
|
66
|
+
"dependencies": {
|
|
67
|
+
"@nodesecure/flags": "^2.2.0",
|
|
68
|
+
"@nodesecure/fs-walk": "^1.0.0",
|
|
69
|
+
"@nodesecure/i18n": "^1.2.1",
|
|
70
|
+
"@nodesecure/js-x-ray": "^4.2.0",
|
|
71
|
+
"@nodesecure/npm-registry-sdk": "^1.3.0",
|
|
72
|
+
"@nodesecure/ntlp": "^2.1.0",
|
|
73
|
+
"@nodesecure/utils": "^1.0.0",
|
|
74
|
+
"@nodesecure/vuln": "^1.5.0",
|
|
75
|
+
"@npm/types": "^1.0.1",
|
|
76
|
+
"@npmcli/arborist": "^4.3.0",
|
|
77
|
+
"@slimio/lock": "^1.0.0",
|
|
78
|
+
"builtins": "^4.0.0",
|
|
79
|
+
"combine-async-iterators": "^2.0.1",
|
|
80
|
+
"itertools": "^1.7.1",
|
|
81
|
+
"lodash.difference": "^4.5.0",
|
|
82
|
+
"pacote": "^12.0.3",
|
|
83
|
+
"semver": "^7.3.4"
|
|
84
|
+
},
|
|
85
|
+
"type": "module"
|
|
86
|
+
}
|