@nodesecure/scanner 3.1.0 → 3.3.0

package/src/tarball.js

@@ -1,173 +1,173 @@
-// Import Node.js Dependencies
-import path from "path";
-import os from "os";
-import timers from "timers/promises";
-
-// Import Third-party Dependencies
-import { runASTAnalysisOnFile } from "@nodesecure/js-x-ray";
-import pacote from "pacote";
-import ntlp from "@nodesecure/ntlp";
-
-// Import Internal Dependencies
-import {
-  getTarballComposition, isSensitiveFile, filterDependencyKind, analyzeDependencies, booleanToFlags,
-  NPM_TOKEN
-} from "./utils/index.js";
-import * as manifest from "./manifest.js";
-import { getLocalRegistryURL } from "@nodesecure/npm-registry-sdk";
-
-// CONSTANTS
-const kNativeCodeExtensions = new Set([".gyp", ".c", ".cpp", ".node", ".so", ".h"]);
-const kJsExtname = new Set([".js", ".mjs", ".cjs"]);
-
-export async function scanJavascriptFile(dest, file, packageName) {
-  const result = await runASTAnalysisOnFile(path.join(dest, file), { packageName });
-
-  const warnings = result.warnings.map((curr) => Object.assign({}, curr, { file }));
-  if (!result.ok) {
-    return {
-      file,
-      warnings,
-      isMinified: false,
-      tryDependencies: [],
-      dependencies: [],
-      filesDependencies: []
-    };
-  }
-  const { packages, files } = filterDependencyKind(result.dependencies, path.dirname(file));
-
-  return {
-    file,
-    warnings,
-    isMinified: result.isMinified,
-    tryDependencies: [...result.dependencies.getDependenciesInTryStatement()],
-    dependencies: packages,
-    filesDependencies: files
-  };
-}
-
-export async function scanDirOrArchive(name, version, options) {
-  const { ref, tmpLocation, locker } = options;
-
-  const isNpmTarball = !(tmpLocation === null);
-  const dest = isNpmTarball ? path.join(tmpLocation, `${name}@${version}`) : process.cwd();
-  const free = await locker.acquireOne();
-
-  try {
-    // If this is an NPM tarball then we extract it on the disk with pacote.
-    if (isNpmTarball) {
-      await pacote.extract(ref.flags.includes("isGit") ? ref.gitUrl : `${name}@${version}`, dest, {
-        ...NPM_TOKEN,
-        registry: getLocalRegistryURL(),
-        cache: `${os.homedir()}/.npm`
-      });
-      await timers.setImmediate();
-    }
-
-    // Read the package.json at the root of the directory or archive.
-    const { packageDeps, packageDevDeps, author, description, hasScript, hasNativeElements } = await manifest.readAnalyze(dest);
-    ref.author = author;
-    ref.description = description;
-
-    // Get the composition of the (extracted) directory
-    const { ext, files, size } = await getTarballComposition(dest);
-    ref.size = size;
-    ref.composition.extensions.push(...ext);
-    ref.composition.files.push(...files);
-    const hasBannedFile = files.some((path) => isSensitiveFile(path));
-    const hasNativeCode = hasNativeElements || files.some((file) => kNativeCodeExtensions.has(path.extname(file)));
-
-    // Search for minified and runtime dependencies
-    // Run a JS-X-Ray analysis on each JavaScript files of the project!
-    const fileAnalysisRaw = await Promise.allSettled(
-      files
-        .filter((name) => kJsExtname.has(path.extname(name)))
-        .map((file) => scanJavascriptFile(dest, file, name))
-    );
-
-    const fileAnalysisResults = fileAnalysisRaw
-      .filter((promiseSettledResult) => promiseSettledResult.status === "fulfilled")
-      .map((promiseSettledResult) => promiseSettledResult.value);
-
-    ref.warnings.push(...fileAnalysisResults.flatMap((row) => row.warnings));
-
-    const dependencies = [...new Set(fileAnalysisResults.flatMap((row) => row.dependencies))];
-    const filesDependencies = [...new Set(fileAnalysisResults.flatMap((row) => row.filesDependencies))];
-    const tryDependencies = new Set(fileAnalysisResults.flatMap((row) => row.tryDependencies));
-    const minifiedFiles = fileAnalysisResults.filter((row) => row.isMinified).flatMap((row) => row.file);
-
-    const {
-      nodeDependencies, thirdPartyDependencies, missingDependencies, unusedDependencies, flags
-    } = analyzeDependencies(dependencies, { packageDeps, packageDevDeps, tryDependencies });
-
-    ref.composition.required_thirdparty = thirdPartyDependencies;
-    ref.composition.unused.push(...unusedDependencies);
-    ref.composition.missing.push(...missingDependencies);
-    ref.composition.required_files = filesDependencies;
-    ref.composition.required_nodejs = nodeDependencies;
-    ref.composition.minified = minifiedFiles;
-
-    // License
-    await timers.setImmediate();
-    const licenses = await ntlp(dest);
-    const uniqueLicenseIds = Array.isArray(licenses.uniqueLicenseIds) ? licenses.uniqueLicenseIds : [];
-    ref.license = licenses;
-    ref.license.uniqueLicenseIds = uniqueLicenseIds;
-
-    ref.flags.push(...booleanToFlags({
-      ...flags,
-      hasNoLicense: uniqueLicenseIds.length === 0,
-      hasMultipleLicenses: licenses.hasMultipleLicenses,
-      hasMinifiedCode: minifiedFiles.length > 0,
-      hasWarnings: ref.warnings.length > 0 && !ref.flags.includes("hasWarnings"),
-      hasBannedFile,
-      hasNativeCode,
-      hasScript
-    }));
-  }
-  catch {
-    // Ignore
-  }
-  finally {
-    free();
-  }
-}
-
-export async function scanPackage(dest, packageName) {
-  const { type = "script", name } = await manifest.read(dest);
-
-  await timers.setImmediate();
-  const { ext, files, size } = await getTarballComposition(dest);
-  ext.delete("");
-
-  // Search for runtime dependencies
-  const dependencies = Object.create(null);
-  const [minified, warnings] = [[], []];
-
-  const JSFiles = files.filter((name) => kJsExtname.has(path.extname(name)));
-  for (const file of JSFiles) {
-    const result = await runASTAnalysisOnFile(path.join(dest, file), {
-      packageName: packageName ?? name,
-      module: type === "module"
-    });
-
-    warnings.push(...result.warnings.map((curr) => Object.assign({}, curr, { file })));
-    if (!result.ok) {
-      continue;
-    }
-
-    dependencies[file] = result.dependencies.dependencies;
-    result.isMinified && minified.push(file);
-  }
-
-  await timers.setImmediate();
-  const { uniqueLicenseIds, licenses } = await ntlp(dest);
-
-  return {
-    files: { list: files, extensions: [...ext], minified },
-    directorySize: size,
-    uniqueLicenseIds,
-    licenses,
-    ast: { dependencies, warnings }
-  };
-}
+// Import Node.js Dependencies
+import path from "path";
+import os from "os";
+import timers from "timers/promises";
+
+// Import Third-party Dependencies
+import { runASTAnalysisOnFile } from "@nodesecure/js-x-ray";
+import pacote from "pacote";
+import ntlp from "@nodesecure/ntlp";
+
+// Import Internal Dependencies
+import {
+  getTarballComposition, isSensitiveFile, filterDependencyKind, analyzeDependencies, booleanToFlags,
+  NPM_TOKEN
+} from "./utils/index.js";
+import * as manifest from "./manifest.js";
+import { getLocalRegistryURL } from "@nodesecure/npm-registry-sdk";
+
+// CONSTANTS
+const kNativeCodeExtensions = new Set([".gyp", ".c", ".cpp", ".node", ".so", ".h"]);
+const kJsExtname = new Set([".js", ".mjs", ".cjs"]);
+
+export async function scanJavascriptFile(dest, file, packageName) {
+  const result = await runASTAnalysisOnFile(path.join(dest, file), { packageName });
+
+  const warnings = result.warnings.map((curr) => Object.assign({}, curr, { file }));
+  if (!result.ok) {
+    return {
+      file,
+      warnings,
+      isMinified: false,
+      tryDependencies: [],
+      dependencies: [],
+      filesDependencies: []
+    };
+  }
+  const { packages, files } = filterDependencyKind(result.dependencies, path.dirname(file));
+
+  return {
+    file,
+    warnings,
+    isMinified: result.isMinified,
+    tryDependencies: [...result.dependencies.getDependenciesInTryStatement()],
+    dependencies: packages,
+    filesDependencies: files
+  };
+}
+
+export async function scanDirOrArchive(name, version, options) {
+  const { ref, location = process.cwd(), tmpLocation, locker } = options;
+
+  const isNpmTarball = !(tmpLocation === null);
+  const dest = isNpmTarball ? path.join(tmpLocation, `${name}@${version}`) : location;
+  const free = await locker.acquireOne();
+
+  try {
+    // If this is an NPM tarball then we extract it on the disk with pacote.
+    if (isNpmTarball) {
+      await pacote.extract(ref.flags.includes("isGit") ? ref.gitUrl : `${name}@${version}`, dest, {
+        ...NPM_TOKEN,
+        registry: getLocalRegistryURL(),
+        cache: `${os.homedir()}/.npm`
+      });
+      await timers.setImmediate();
+    }
+
+    // Read the package.json at the root of the directory or archive.
+    const { packageDeps, packageDevDeps, author, description, hasScript, hasNativeElements } = await manifest.readAnalyze(dest);
+    ref.author = author;
+    ref.description = description;
+
+    // Get the composition of the (extracted) directory
+    const { ext, files, size } = await getTarballComposition(dest);
+    ref.size = size;
+    ref.composition.extensions.push(...ext);
+    ref.composition.files.push(...files);
+    const hasBannedFile = files.some((path) => isSensitiveFile(path));
+    const hasNativeCode = hasNativeElements || files.some((file) => kNativeCodeExtensions.has(path.extname(file)));
+
+    // Search for minified and runtime dependencies
+    // Run a JS-X-Ray analysis on each JavaScript files of the project!
+    const fileAnalysisRaw = await Promise.allSettled(
+      files
+        .filter((name) => kJsExtname.has(path.extname(name)))
+        .map((file) => scanJavascriptFile(dest, file, name))
+    );
+
+    const fileAnalysisResults = fileAnalysisRaw
+      .filter((promiseSettledResult) => promiseSettledResult.status === "fulfilled")
+      .map((promiseSettledResult) => promiseSettledResult.value);
+
+    ref.warnings.push(...fileAnalysisResults.flatMap((row) => row.warnings));
+
+    const dependencies = [...new Set(fileAnalysisResults.flatMap((row) => row.dependencies))];
+    const filesDependencies = [...new Set(fileAnalysisResults.flatMap((row) => row.filesDependencies))];
+    const tryDependencies = new Set(fileAnalysisResults.flatMap((row) => row.tryDependencies));
+    const minifiedFiles = fileAnalysisResults.filter((row) => row.isMinified).flatMap((row) => row.file);
+
+    const {
+      nodeDependencies, thirdPartyDependencies, missingDependencies, unusedDependencies, flags
+    } = analyzeDependencies(dependencies, { packageDeps, packageDevDeps, tryDependencies });
+
+    ref.composition.required_thirdparty = thirdPartyDependencies;
+    ref.composition.unused.push(...unusedDependencies);
+    ref.composition.missing.push(...missingDependencies);
+    ref.composition.required_files = filesDependencies;
+    ref.composition.required_nodejs = nodeDependencies;
+    ref.composition.minified = minifiedFiles;
+
+    // License
+    await timers.setImmediate();
+    const licenses = await ntlp(dest);
+    const uniqueLicenseIds = Array.isArray(licenses.uniqueLicenseIds) ? licenses.uniqueLicenseIds : [];
+    ref.license = licenses;
+    ref.license.uniqueLicenseIds = uniqueLicenseIds;
+
+    ref.flags.push(...booleanToFlags({
+      ...flags,
+      hasNoLicense: uniqueLicenseIds.length === 0,
+      hasMultipleLicenses: licenses.hasMultipleLicenses,
+      hasMinifiedCode: minifiedFiles.length > 0,
+      hasWarnings: ref.warnings.length > 0 && !ref.flags.includes("hasWarnings"),
+      hasBannedFile,
+      hasNativeCode,
+      hasScript
+    }));
+  }
+  catch {
+    // Ignore
+  }
+  finally {
+    free();
+  }
+}
+
+export async function scanPackage(dest, packageName) {
+  const { type = "script", name } = await manifest.read(dest);
+
+  await timers.setImmediate();
+  const { ext, files, size } = await getTarballComposition(dest);
+  ext.delete("");
+
+  // Search for runtime dependencies
+  const dependencies = Object.create(null);
+  const [minified, warnings] = [[], []];
+
+  const JSFiles = files.filter((name) => kJsExtname.has(path.extname(name)));
+  for (const file of JSFiles) {
+    const result = await runASTAnalysisOnFile(path.join(dest, file), {
+      packageName: packageName ?? name,
+      module: type === "module"
+    });
+
+    warnings.push(...result.warnings.map((curr) => Object.assign({}, curr, { file })));
+    if (!result.ok) {
+      continue;
+    }
+
+    dependencies[file] = result.dependencies.dependencies;
+    result.isMinified && minified.push(file);
+  }
+
+  await timers.setImmediate();
+  const { uniqueLicenseIds, licenses } = await ntlp(dest);
+
+  return {
+    files: { list: files, extensions: [...ext], minified },
+    directorySize: size,
+    uniqueLicenseIds,
+    licenses,
+    ast: { dependencies, warnings }
+  };
+}

package/src/utils/warnings.js

@@ -8,6 +8,7 @@ const kWarningsMessages = Object.freeze({
   iohook: getToken("warnings.keylogging")
 });
 const kPackages = new Set(Object.keys(kWarningsMessages));
+const kAuthors = new Set(["marak", "marak.squires@gmail.com"]);
 
 function getWarning(depName) {
   return `${kDetectedDep(depName)} ${kWarningsMessages[depName]}`;
@@ -21,6 +22,15 @@ export function getDependenciesWarnings(dependencies) {
     }
   }
 
+  // TODO: optimize with @nodesecure/author later
+  for (const [packageName, dependency] of dependencies) {
+    for (const { name, email } of dependency.metadata.maintainers) {
+      if (kAuthors.has(name) || kAuthors.has(email)) {
+        warnings.push(`'Marak Squires' package '${packageName}' has been detected in the dependency tree`);
+      }
+    }
+  }
+
   return warnings;
 }
 

package/types/api.d.ts

@@ -1,15 +1,15 @@
-import Scanner from "./scanner";
-import { Logger, LoggerEvents } from "./logger";
-
-export {
-  cwd,
-  from,
-  verify,
-  ScannerLoggerEvents
-}
-
-declare const ScannerLoggerEvents: LoggerEvents;
-
-declare function cwd(path: string, options?: Scanner.Options, logger?: Logger): Promise<Scanner.Payload>;
-declare function from(packageName: string, options?: Scanner.Options, logger?: Logger): Promise<Scanner.Payload>;
-declare function verify(packageName: string): Promise<Scanner.VerifyPayload>;
+import Scanner from "./scanner";
+import { Logger, LoggerEvents } from "./logger";
+
+export {
+  cwd,
+  from,
+  verify,
+  ScannerLoggerEvents
+}
+
+declare const ScannerLoggerEvents: LoggerEvents;
+
+declare function cwd(location: string, options?: Scanner.Options, logger?: Logger): Promise<Scanner.Payload>;
+declare function from(packageName: string, options?: Scanner.Options, logger?: Logger): Promise<Scanner.Payload>;
+declare function verify(packageName?: string | null): Promise<Scanner.VerifyPayload>;

package/types/scanner.d.ts

@@ -128,7 +128,7 @@ declare namespace Scanner {
     /** All the dependencies of the package (flattened) */
     dependencies: Dependencies;
     /** Version of the scanner used to generate the result */
-    version: string;
+    scannerVersion: string;
     /** Vulnerability strategy name (npm, snyk, node) */
     vulnerabilityStrategy: Vuln.Strategy.Kind;
   }