@nodesecure/scanner 3.6.0 → 3.7.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +99 -97
- package/index.js +14 -3
- package/package.json +10 -10
- package/src/depWalker.js +23 -14
- package/src/tarball.js +2 -3
- package/types/scanner.d.ts +1 -0
package/README.md
CHANGED
|
@@ -1,97 +1,99 @@
|
|
|
1
|
-
# NodeSecure Scanner
|
|
2
|
-
|
|
3
|
-
[](https://github.com/NodeSecure/scanner/commit-activity)
|
|
4
|
-
[](https://github.com/nodejs/security-wg/blob/master/processes/responsible_disclosure_template.md
|
|
5
|
-
)
|
|
6
|
-
[](https://github.com/NodeSecure/scanner/blob/master/LICENSE)
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
⚡️ Run a static analysis of your module's dependencies.
|
|
10
|
-
|
|
11
|
-
## Requirements
|
|
12
|
-
|
|
13
|
-
- [Node.js](https://nodejs.org/en/) version 16 or higher
|
|
14
|
-
|
|
15
|
-
## Getting Started
|
|
16
|
-
|
|
17
|
-
This package is available in the Node Package Repository and can be easily installed with [npm](https://docs.npmjs.com/getting-started/what-is-npm) or [yarn](https://yarnpkg.com).
|
|
18
|
-
|
|
19
|
-
```bash
|
|
20
|
-
$ npm i @nodesecure/scanner
|
|
21
|
-
# or
|
|
22
|
-
$ yarn add @nodesecure/scanner
|
|
23
|
-
```
|
|
24
|
-
|
|
25
|
-
## Usage example
|
|
26
|
-
|
|
27
|
-
```js
|
|
28
|
-
import * as scanner from "@nodesecure/scanner";
|
|
29
|
-
import fs from "fs/promises";
|
|
30
|
-
|
|
31
|
-
// CONSTANTS
|
|
32
|
-
const kPackagesToAnalyze = ["mocha", "cacache", "is-wsl"];
|
|
33
|
-
|
|
34
|
-
const payloads = await Promise.all(
|
|
35
|
-
kPackagesToAnalyze.map((name) => scanner.from(name))
|
|
36
|
-
);
|
|
37
|
-
|
|
38
|
-
const promises = [];
|
|
39
|
-
for (let i = 0; i < kPackagesToAnalyze.length; i++) {
|
|
40
|
-
const data = JSON.stringify(payloads[i], null, 2);
|
|
41
|
-
|
|
42
|
-
promises.push(fs.writeFile(`${kPackagesToAnalyze[i]}.json`, data));
|
|
43
|
-
}
|
|
44
|
-
await Promise.allSettled(promises);
|
|
45
|
-
```
|
|
46
|
-
|
|
47
|
-
## API
|
|
48
|
-
|
|
49
|
-
See `types/api.d.ts` for a complete TypeScript definition.
|
|
50
|
-
|
|
51
|
-
```ts
|
|
52
|
-
function cwd(location: string, options?: Scanner.Options): Promise<Scanner.Payload>;
|
|
53
|
-
function from(packageName: string, options?: Omit<Scanner.Options, "includeDevDeps">): Promise<Scanner.Payload>;
|
|
54
|
-
function verify(packageName?: string | null): Promise<Scanner.VerifyPayload>;
|
|
55
|
-
```
|
|
56
|
-
|
|
57
|
-
`Options` is described with the following TypeScript interface:
|
|
58
|
-
|
|
59
|
-
```ts
|
|
60
|
-
interface Options {
|
|
61
|
-
readonly maxDepth?: number;
|
|
62
|
-
readonly
|
|
63
|
-
readonly
|
|
64
|
-
readonly
|
|
65
|
-
readonly
|
|
66
|
-
readonly
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
<!--
|
|
80
|
-
<!--
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
<td align="center"><a href="
|
|
85
|
-
<td align="center"><a href="
|
|
86
|
-
<td align="center"><a href="https://
|
|
87
|
-
<td align="center"><a href="https://
|
|
88
|
-
|
|
89
|
-
</
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
<!--
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
1
|
+
# NodeSecure Scanner
|
|
2
|
+
|
|
3
|
+
[](https://github.com/NodeSecure/scanner/commit-activity)
|
|
4
|
+
[](https://github.com/nodejs/security-wg/blob/master/processes/responsible_disclosure_template.md
|
|
5
|
+
)
|
|
6
|
+
[](https://github.com/NodeSecure/scanner/blob/master/LICENSE)
|
|
7
|
+
|
|
8
|
+
|
|
9
|
+
⚡️ Run a static analysis of your module's dependencies.
|
|
10
|
+
|
|
11
|
+
## Requirements
|
|
12
|
+
|
|
13
|
+
- [Node.js](https://nodejs.org/en/) version 16 or higher
|
|
14
|
+
|
|
15
|
+
## Getting Started
|
|
16
|
+
|
|
17
|
+
This package is available in the Node Package Repository and can be easily installed with [npm](https://docs.npmjs.com/getting-started/what-is-npm) or [yarn](https://yarnpkg.com).
|
|
18
|
+
|
|
19
|
+
```bash
|
|
20
|
+
$ npm i @nodesecure/scanner
|
|
21
|
+
# or
|
|
22
|
+
$ yarn add @nodesecure/scanner
|
|
23
|
+
```
|
|
24
|
+
|
|
25
|
+
## Usage example
|
|
26
|
+
|
|
27
|
+
```js
|
|
28
|
+
import * as scanner from "@nodesecure/scanner";
|
|
29
|
+
import fs from "fs/promises";
|
|
30
|
+
|
|
31
|
+
// CONSTANTS
|
|
32
|
+
const kPackagesToAnalyze = ["mocha", "cacache", "is-wsl"];
|
|
33
|
+
|
|
34
|
+
const payloads = await Promise.all(
|
|
35
|
+
kPackagesToAnalyze.map((name) => scanner.from(name))
|
|
36
|
+
);
|
|
37
|
+
|
|
38
|
+
const promises = [];
|
|
39
|
+
for (let i = 0; i < kPackagesToAnalyze.length; i++) {
|
|
40
|
+
const data = JSON.stringify(payloads[i], null, 2);
|
|
41
|
+
|
|
42
|
+
promises.push(fs.writeFile(`${kPackagesToAnalyze[i]}.json`, data));
|
|
43
|
+
}
|
|
44
|
+
await Promise.allSettled(promises);
|
|
45
|
+
```
|
|
46
|
+
|
|
47
|
+
## API
|
|
48
|
+
|
|
49
|
+
See `types/api.d.ts` for a complete TypeScript definition.
|
|
50
|
+
|
|
51
|
+
```ts
|
|
52
|
+
function cwd(location: string, options?: Scanner.Options): Promise<Scanner.Payload>;
|
|
53
|
+
function from(packageName: string, options?: Omit<Scanner.Options, "includeDevDeps">): Promise<Scanner.Payload>;
|
|
54
|
+
function verify(packageName?: string | null): Promise<Scanner.VerifyPayload>;
|
|
55
|
+
```
|
|
56
|
+
|
|
57
|
+
`Options` is described with the following TypeScript interface:
|
|
58
|
+
|
|
59
|
+
```ts
|
|
60
|
+
interface Options {
|
|
61
|
+
readonly maxDepth?: number;
|
|
62
|
+
readonly registry?: string | URL;
|
|
63
|
+
readonly usePackageLock?: boolean;
|
|
64
|
+
readonly includeDevDeps?: boolean;
|
|
65
|
+
readonly vulnerabilityStrategy: Strategy.Kind;
|
|
66
|
+
readonly forceRootAnalysis?: boolean;
|
|
67
|
+
readonly fullLockMode?: boolean;
|
|
68
|
+
}
|
|
69
|
+
```
|
|
70
|
+
|
|
71
|
+
## Contributors ✨
|
|
72
|
+
|
|
73
|
+
<!-- ALL-CONTRIBUTORS-BADGE:START - Do not remove or modify this section -->
|
|
74
|
+
[](#contributors-)
|
|
75
|
+
<!-- ALL-CONTRIBUTORS-BADGE:END -->
|
|
76
|
+
|
|
77
|
+
Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/docs/en/emoji-key)):
|
|
78
|
+
|
|
79
|
+
<!-- ALL-CONTRIBUTORS-LIST:START - Do not remove or modify this section -->
|
|
80
|
+
<!-- prettier-ignore-start -->
|
|
81
|
+
<!-- markdownlint-disable -->
|
|
82
|
+
<table>
|
|
83
|
+
<tr>
|
|
84
|
+
<td align="center"><a href="https://www.linkedin.com/in/thomas-gentilhomme/"><img src="https://avatars.githubusercontent.com/u/4438263?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Gentilhomme</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=fraxken" title="Code">💻</a> <a href="https://github.com/NodeSecure/scanner/commits?author=fraxken" title="Documentation">📖</a> <a href="https://github.com/NodeSecure/scanner/pulls?q=is%3Apr+reviewed-by%3Afraxken" title="Reviewed Pull Requests">👀</a> <a href="#security-fraxken" title="Security">🛡️</a> <a href="https://github.com/NodeSecure/scanner/issues?q=author%3Afraxken" title="Bug reports">🐛</a></td>
|
|
85
|
+
<td align="center"><a href="http://tonygo.dev"><img src="https://avatars.githubusercontent.com/u/22824417?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Tony Gorez</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=tony-go" title="Code">💻</a> <a href="https://github.com/NodeSecure/scanner/commits?author=tony-go" title="Documentation">📖</a> <a href="https://github.com/NodeSecure/scanner/pulls?q=is%3Apr+reviewed-by%3Atony-go" title="Reviewed Pull Requests">👀</a> <a href="https://github.com/NodeSecure/scanner/issues?q=author%3Atony-go" title="Bug reports">🐛</a></td>
|
|
86
|
+
<td align="center"><a href="https://mickaelcroquet.fr"><img src="https://avatars.githubusercontent.com/u/23740372?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Haze</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=CroquetMickael" title="Code">💻</a></td>
|
|
87
|
+
<td align="center"><a href="https://github.com/mbalabash"><img src="https://avatars.githubusercontent.com/u/16868922?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Maksim Balabash</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=mbalabash" title="Code">💻</a></td>
|
|
88
|
+
<td align="center"><a href="https://dev.to/antoinecoulon"><img src="https://avatars.githubusercontent.com/u/43391199?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Antoine Coulon</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=antoine-coulon" title="Code">💻</a> <a href="#security-antoine-coulon" title="Security">🛡️</a></td>
|
|
89
|
+
<td align="center"><a href="https://www.linkedin.com/in/nicolas-hallaert/"><img src="https://avatars.githubusercontent.com/u/39910164?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Nicolas Hallaert</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=Rossb0b" title="Code">💻</a></td>
|
|
90
|
+
</tr>
|
|
91
|
+
</table>
|
|
92
|
+
|
|
93
|
+
<!-- markdownlint-restore -->
|
|
94
|
+
<!-- prettier-ignore-end -->
|
|
95
|
+
|
|
96
|
+
<!-- ALL-CONTRIBUTORS-LIST:END -->
|
|
97
|
+
|
|
98
|
+
## License
|
|
99
|
+
MIT
|
package/index.js
CHANGED
|
@@ -19,7 +19,16 @@ import * as tarball from "./src/tarball.js";
|
|
|
19
19
|
const kDefaultCwdOptions = { forceRootAnalysis: true, usePackageLock: true, includeDevDeps: false };
|
|
20
20
|
|
|
21
21
|
export async function cwd(location = process.cwd(), options = {}, logger = new Logger()) {
|
|
22
|
-
const
|
|
22
|
+
const registry = options.registry ? new URL(options.registry).toString() : getLocalRegistryURL();
|
|
23
|
+
|
|
24
|
+
const finalizedOptions = Object.assign(
|
|
25
|
+
{ location },
|
|
26
|
+
kDefaultCwdOptions,
|
|
27
|
+
{
|
|
28
|
+
...options,
|
|
29
|
+
registry
|
|
30
|
+
}
|
|
31
|
+
);
|
|
23
32
|
|
|
24
33
|
logger.start(ScannerLoggerEvents.manifest.read);
|
|
25
34
|
const packagePath = path.join(location, "package.json");
|
|
@@ -30,13 +39,15 @@ export async function cwd(location = process.cwd(), options = {}, logger = new L
|
|
|
30
39
|
}
|
|
31
40
|
|
|
32
41
|
export async function from(packageName, options, logger = new Logger()) {
|
|
42
|
+
const registry = options.registry ? new URL(options.registry).toString() : getLocalRegistryURL();
|
|
43
|
+
|
|
33
44
|
logger.start(ScannerLoggerEvents.manifest.fetch);
|
|
34
45
|
const manifest = await pacote.manifest(packageName, {
|
|
35
|
-
...NPM_TOKEN, registry
|
|
46
|
+
...NPM_TOKEN, registry, cache: `${os.homedir()}/.npm`
|
|
36
47
|
});
|
|
37
48
|
logger.end(ScannerLoggerEvents.manifest.fetch);
|
|
38
49
|
|
|
39
|
-
return depWalker(manifest, options, logger);
|
|
50
|
+
return depWalker(manifest, Object.assign(options, { registry }), logger);
|
|
40
51
|
}
|
|
41
52
|
|
|
42
53
|
export async function verify(packageName = null) {
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@nodesecure/scanner",
|
|
3
|
-
"version": "3.
|
|
3
|
+
"version": "3.7.0",
|
|
4
4
|
"description": "A package API to run a static analysis of your module's dependencies.",
|
|
5
5
|
"exports": "./index.js",
|
|
6
6
|
"engines": {
|
|
@@ -48,15 +48,15 @@
|
|
|
48
48
|
},
|
|
49
49
|
"homepage": "https://github.com/NodeSecure/scanner#readme",
|
|
50
50
|
"devDependencies": {
|
|
51
|
-
"@nodesecure/eslint-config": "^1.4.
|
|
51
|
+
"@nodesecure/eslint-config": "^1.4.1",
|
|
52
52
|
"@slimio/is": "^1.5.1",
|
|
53
53
|
"@small-tech/esm-tape-runner": "^2.0.0",
|
|
54
54
|
"@small-tech/tap-monkey": "^1.4.0",
|
|
55
|
-
"@types/node": "^
|
|
55
|
+
"@types/node": "^18.0.0",
|
|
56
56
|
"c8": "^7.11.3",
|
|
57
57
|
"cross-env": "^7.0.3",
|
|
58
58
|
"dotenv": "^16.0.1",
|
|
59
|
-
"eslint": "^8.
|
|
59
|
+
"eslint": "^8.18.0",
|
|
60
60
|
"get-folder-size": "^3.1.0",
|
|
61
61
|
"pkg-ok": "^3.0.0",
|
|
62
62
|
"sinon": "^14.0.0",
|
|
@@ -64,22 +64,22 @@
|
|
|
64
64
|
"tape": "^5.5.3"
|
|
65
65
|
},
|
|
66
66
|
"dependencies": {
|
|
67
|
-
"@nodesecure/flags": "^2.
|
|
67
|
+
"@nodesecure/flags": "^2.4.0",
|
|
68
68
|
"@nodesecure/fs-walk": "^1.0.0",
|
|
69
|
-
"@nodesecure/i18n": "^
|
|
70
|
-
"@nodesecure/js-x-ray": "^
|
|
71
|
-
"@nodesecure/npm-registry-sdk": "^1.
|
|
69
|
+
"@nodesecure/i18n": "^2.0.0",
|
|
70
|
+
"@nodesecure/js-x-ray": "^5.0.1",
|
|
71
|
+
"@nodesecure/npm-registry-sdk": "^1.4.0",
|
|
72
72
|
"@nodesecure/ntlp": "^2.1.0",
|
|
73
73
|
"@nodesecure/utils": "^1.0.0",
|
|
74
74
|
"@nodesecure/vuln": "^1.7.0",
|
|
75
75
|
"@npm/types": "^1.0.2",
|
|
76
|
-
"@npmcli/arborist": "^5.2.
|
|
76
|
+
"@npmcli/arborist": "^5.2.3",
|
|
77
77
|
"@slimio/lock": "^1.0.0",
|
|
78
78
|
"builtins": "^5.0.1",
|
|
79
79
|
"combine-async-iterators": "^2.0.1",
|
|
80
80
|
"itertools": "^1.7.1",
|
|
81
81
|
"lodash.difference": "^4.5.0",
|
|
82
|
-
"pacote": "^13.6.
|
|
82
|
+
"pacote": "^13.6.1",
|
|
83
83
|
"semver": "^7.3.7"
|
|
84
84
|
},
|
|
85
85
|
"type": "module"
|
package/src/depWalker.js
CHANGED
|
@@ -11,7 +11,6 @@ import pacote from "pacote";
|
|
|
11
11
|
import Arborist from "@npmcli/arborist";
|
|
12
12
|
import Lock from "@slimio/lock";
|
|
13
13
|
import * as vuln from "@nodesecure/vuln";
|
|
14
|
-
import { getLocalRegistryURL } from "@nodesecure/npm-registry-sdk";
|
|
15
14
|
import { ScannerLoggerEvents } from "./constants.js";
|
|
16
15
|
|
|
17
16
|
// Import Internal Dependencies
|
|
@@ -31,11 +30,11 @@ const { version: packageVersion } = JSON.parse(
|
|
|
31
30
|
);
|
|
32
31
|
|
|
33
32
|
export async function* searchDeepDependencies(packageName, gitURL, options) {
|
|
34
|
-
const { exclude, currDepth = 0, parent, maxDepth } = options;
|
|
33
|
+
const { exclude, currDepth = 0, parent, maxDepth, registry } = options;
|
|
35
34
|
|
|
36
35
|
const { name, version, deprecated, ...pkg } = await pacote.manifest(gitURL ?? packageName, {
|
|
37
36
|
...NPM_TOKEN,
|
|
38
|
-
registry
|
|
37
|
+
registry,
|
|
39
38
|
cache: `${os.homedir()}/.npm`
|
|
40
39
|
});
|
|
41
40
|
const { dependencies, customResolvers } = mergeDependencies(pkg);
|
|
@@ -48,7 +47,7 @@ export async function* searchDeepDependencies(packageName, gitURL, options) {
|
|
|
48
47
|
|
|
49
48
|
if (currDepth !== maxDepth) {
|
|
50
49
|
const config = {
|
|
51
|
-
exclude, currDepth: currDepth + 1, parent: current, maxDepth
|
|
50
|
+
exclude, currDepth: currDepth + 1, parent: current, maxDepth, registry
|
|
52
51
|
};
|
|
53
52
|
|
|
54
53
|
const gitDependencies = iter.filter(customResolvers.entries(), ([, valueStr]) => isGitDependency(valueStr));
|
|
@@ -76,7 +75,7 @@ export async function* searchDeepDependencies(packageName, gitURL, options) {
|
|
|
76
75
|
}
|
|
77
76
|
|
|
78
77
|
export async function* deepReadEdges(currentPackageName, options) {
|
|
79
|
-
const { to, parent, exclude, fullLockMode, includeDevDeps } = options;
|
|
78
|
+
const { to, parent, exclude, fullLockMode, includeDevDeps, registry } = options;
|
|
80
79
|
const { version, integrity = to.integrity } = to.package;
|
|
81
80
|
|
|
82
81
|
const updatedVersion = version === "*" || typeof version === "undefined" ? "latest" : version;
|
|
@@ -86,7 +85,7 @@ export async function* deepReadEdges(currentPackageName, options) {
|
|
|
86
85
|
if (fullLockMode && !includeDevDeps) {
|
|
87
86
|
const { deprecated, _integrity, ...pkg } = await pacote.manifest(`${currentPackageName}@${updatedVersion}`, {
|
|
88
87
|
...NPM_TOKEN,
|
|
89
|
-
registry
|
|
88
|
+
registry,
|
|
90
89
|
cache: `${os.homedir()}/.npm`
|
|
91
90
|
});
|
|
92
91
|
const { customResolvers } = mergeDependencies(pkg);
|
|
@@ -108,7 +107,7 @@ export async function* deepReadEdges(currentPackageName, options) {
|
|
|
108
107
|
}
|
|
109
108
|
else {
|
|
110
109
|
exclude.set(cleanName, new Set([current.fullName]));
|
|
111
|
-
yield* deepReadEdges(packageName, { parent: current, to: toNode, exclude });
|
|
110
|
+
yield* deepReadEdges(packageName, { parent: current, to: toNode, exclude, registry });
|
|
112
111
|
}
|
|
113
112
|
}
|
|
114
113
|
yield current;
|
|
@@ -118,7 +117,8 @@ export async function* getRootDependencies(manifest, options) {
|
|
|
118
117
|
const {
|
|
119
118
|
maxDepth = 4, exclude,
|
|
120
119
|
usePackageLock, fullLockMode, includeDevDeps,
|
|
121
|
-
location
|
|
120
|
+
location,
|
|
121
|
+
registry
|
|
122
122
|
} = options;
|
|
123
123
|
|
|
124
124
|
const { dependencies, customResolvers } = mergeDependencies(manifest, void 0);
|
|
@@ -131,7 +131,7 @@ export async function* getRootDependencies(manifest, options) {
|
|
|
131
131
|
const arb = new Arborist({
|
|
132
132
|
...NPM_TOKEN,
|
|
133
133
|
path: location,
|
|
134
|
-
registry
|
|
134
|
+
registry
|
|
135
135
|
});
|
|
136
136
|
let tree;
|
|
137
137
|
try {
|
|
@@ -146,11 +146,18 @@ export async function* getRootDependencies(manifest, options) {
|
|
|
146
146
|
...iter
|
|
147
147
|
.filter(tree.edgesOut.entries(), ([, { to }]) => to !== null && (includeDevDeps ? true : (!to.dev || to.isWorkspace)))
|
|
148
148
|
.map(([packageName, { to }]) => [packageName, to.isWorkspace ? to.target : to])
|
|
149
|
-
.map(([packageName, to]) => deepReadEdges(packageName, {
|
|
149
|
+
.map(([packageName, to]) => deepReadEdges(packageName, {
|
|
150
|
+
to,
|
|
151
|
+
parent,
|
|
152
|
+
fullLockMode,
|
|
153
|
+
includeDevDeps,
|
|
154
|
+
exclude,
|
|
155
|
+
registry
|
|
156
|
+
}))
|
|
150
157
|
];
|
|
151
158
|
}
|
|
152
159
|
else {
|
|
153
|
-
const configRef = { exclude, maxDepth, parent };
|
|
160
|
+
const configRef = { exclude, maxDepth, parent, registry };
|
|
154
161
|
iterators = [
|
|
155
162
|
...iter.filter(customResolvers.entries(), ([, valueStr]) => isGitDependency(valueStr))
|
|
156
163
|
.map(([depName, valueStr]) => searchDeepDependencies(depName, valueStr, configRef)),
|
|
@@ -189,7 +196,8 @@ export async function depWalker(manifest, options = {}, logger = new Logger()) {
|
|
|
189
196
|
fullLockMode = false,
|
|
190
197
|
maxDepth,
|
|
191
198
|
location,
|
|
192
|
-
vulnerabilityStrategy = vuln.strategies.NONE
|
|
199
|
+
vulnerabilityStrategy = vuln.strategies.NONE,
|
|
200
|
+
registry
|
|
193
201
|
} = options;
|
|
194
202
|
|
|
195
203
|
// Create TMP directory
|
|
@@ -218,7 +226,7 @@ export async function depWalker(manifest, options = {}, logger = new Logger()) {
|
|
|
218
226
|
const tarballLocker = new Lock({ maxConcurrent: 5 });
|
|
219
227
|
tarballLocker.on("freeOne", () => logger.tick(ScannerLoggerEvents.analysis.tarball));
|
|
220
228
|
|
|
221
|
-
const rootDepsOptions = { maxDepth, exclude, usePackageLock, fullLockMode, includeDevDeps, location };
|
|
229
|
+
const rootDepsOptions = { maxDepth, exclude, usePackageLock, fullLockMode, includeDevDeps, location, registry };
|
|
222
230
|
for await (const currentDep of getRootDependencies(manifest, rootDepsOptions)) {
|
|
223
231
|
const { name, version, dev } = currentDep;
|
|
224
232
|
const current = currentDep.exportAsPlainObject(name === manifest.name ? 0 : void 0);
|
|
@@ -267,7 +275,8 @@ export async function depWalker(manifest, options = {}, logger = new Logger()) {
|
|
|
267
275
|
location,
|
|
268
276
|
tmpLocation: forceRootAnalysis && name === manifest.name ? null : tmpLocation,
|
|
269
277
|
locker: tarballLocker,
|
|
270
|
-
logger
|
|
278
|
+
logger,
|
|
279
|
+
registry
|
|
271
280
|
}));
|
|
272
281
|
}
|
|
273
282
|
}
|
package/src/tarball.js
CHANGED
|
@@ -14,7 +14,6 @@ import {
|
|
|
14
14
|
NPM_TOKEN
|
|
15
15
|
} from "./utils/index.js";
|
|
16
16
|
import * as manifest from "./manifest.js";
|
|
17
|
-
import { getLocalRegistryURL } from "@nodesecure/npm-registry-sdk";
|
|
18
17
|
|
|
19
18
|
// CONSTANTS
|
|
20
19
|
const kNativeCodeExtensions = new Set([".gyp", ".c", ".cpp", ".node", ".so", ".h"]);
|
|
@@ -47,7 +46,7 @@ export async function scanJavascriptFile(dest, file, packageName) {
|
|
|
47
46
|
}
|
|
48
47
|
|
|
49
48
|
export async function scanDirOrArchive(name, version, options) {
|
|
50
|
-
const { ref, location = process.cwd(), tmpLocation, locker } = options;
|
|
49
|
+
const { ref, location = process.cwd(), tmpLocation, locker, registry } = options;
|
|
51
50
|
|
|
52
51
|
const isNpmTarball = !(tmpLocation === null);
|
|
53
52
|
const dest = isNpmTarball ? path.join(tmpLocation, `${name}@${version}`) : location;
|
|
@@ -58,7 +57,7 @@ export async function scanDirOrArchive(name, version, options) {
|
|
|
58
57
|
if (isNpmTarball) {
|
|
59
58
|
await pacote.extract(ref.flags.includes("isGit") ? ref.gitUrl : `${name}@${version}`, dest, {
|
|
60
59
|
...NPM_TOKEN,
|
|
61
|
-
registry
|
|
60
|
+
registry,
|
|
62
61
|
cache: `${os.homedir()}/.npm`
|
|
63
62
|
});
|
|
64
63
|
await timers.setImmediate();
|
package/types/scanner.d.ts
CHANGED