@nodesecure/scanner 5.2.0 → 5.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nodesecure/scanner",
-  "version": "5.2.0",
+  "version": "5.3.0",
   "description": "A package API to run a static analysis of your module's dependencies.",
   "exports": "./index.js",
   "engines": {

package/src/depWalker.js

@@ -268,7 +268,7 @@ export async function depWalker(manifest, options = {}, logger = new Logger()) {
 
       if (dependencies.has(name)) {
         const dep = dependencies.get(name);
-        promisesToWait.push(manifestMetadata(name, version, dep.metadata));
+        promisesToWait.push(manifestMetadata(name, version, dep));
 
         const currVersion = Object.keys(current.versions)[0];
         if (currVersion in dep.versions) {

package/src/npmRegistry.js

@@ -3,17 +3,28 @@ import crypto from "node:crypto";
 
 // Import Third-party Dependencies
 import semver from "semver";
-import { packument, packumentVersion } from "@nodesecure/npm-registry-sdk";
+import { packument, packumentVersion, user as npmUserProfile } from "@nodesecure/npm-registry-sdk";
 
 // Import Internal Dependencies
 import { parseAuthor, getLinks } from "./utils/index.js";
 
-export async function manifestMetadata(name, version, metadata) {
+export async function manifestMetadata(
+  name,
+  version,
+  dependency
+) {
   try {
     const pkgVersion = await packumentVersion(name, version);
 
     const integrity = getPackumentVersionIntegrity(pkgVersion);
-    metadata.integrity[version] = integrity;
+    Object.assign(
+      dependency.versions[version],
+      {
+        links: getLinks(pkgVersion)
+      }
+    );
+
+    dependency.metadata.integrity[version] = integrity;
   }
   catch {
     // Ignore
@@ -91,6 +102,7 @@ export async function packageMetadata(name, version, options) {
       }
     }
 
+    await addNpmAvatar(metadata);
     Object.assign(ref.versions[version], { links: getLinks(pkg.versions[version]) });
     Object.assign(ref.metadata, metadata);
   }
@@ -123,3 +135,34 @@ function getPackumentVersionIntegrity(packumentVersion) {
     .update(JSON.stringify(integrityObj))
     .digest("hex");
 }
+
+async function addNpmAvatar(metadata) {
+  const contributors = [metadata.author, ...metadata.maintainers, ...metadata.publishers];
+  const emailToAvatar = {};
+
+  const promises = contributors.map((contributor) => {
+    if (contributor.email && emailToAvatar[contributor.email]) {
+      contributor.npmAvatar = emailToAvatar[contributor.email];
+
+      return Promise.resolve();
+    }
+
+    return npmUserProfile(contributor.name, { perPage: 1 }).then((profile) => {
+      contributor.npmAvatar = profile.avatars.small;
+      if (contributor.email && contributor.npmAvatar) {
+        emailToAvatar[contributor.email] = contributor.npmAvatar;
+      }
+    }).catch(() => {
+      contributor.npmAvatar = null;
+    });
+  });
+
+  await Promise.all(promises);
+
+  // back fill npmAvatar if any name property was not npm username in first pass
+  for (const contributor of contributors) {
+    if (!contributor.npmAvatar && contributor.email && emailToAvatar[contributor.email]) {
+      contributor.npmAvatar = emailToAvatar[contributor.email];
+    }
+  }
+}

package/src/utils/getLinks.js

@@ -19,12 +19,17 @@ function getVCSRepositoryURL(link) {
   }
 }
 
-export function getLinks(pkg) {
-  const homepage = pkg.homepage || null;
-  const repositoryUrl = pkg.repository?.url || null;
+/**
+ * @param {import("@nodesecure/npm-registry-sdk").PackumentVersion} packumentVersion
+ */
+export function getLinks(
+  packumentVersion
+) {
+  const homepage = packumentVersion.homepage || null;
+  const repositoryUrl = packumentVersion.repository?.url || null;
 
   return {
-    npm: `https://www.npmjs.com/package/${pkg.name}/v/${pkg.version}`,
+    npm: `https://www.npmjs.com/package/${packumentVersion.name}/v/${packumentVersion.version}`,
     homepage,
     repository: getVCSRepositoryURL(homepage) ?? getVCSRepositoryURL(repositoryUrl)
   };

package/types/scanner.d.ts

@@ -13,11 +13,13 @@ declare namespace Scanner {
     name: string;
     email?: string;
     url?: string;
+    npmAvatar?: string;
   }
 
   export interface Maintainer {
     name: string;
     email: string;
+    npmAvatar?: string;
   }
 
   export interface Publisher {
@@ -38,6 +40,11 @@ declare namespace Scanner {
      * @example 2021-08-10T20:45:08.342Z
      */
     at: string;
+    /**
+     * Path to publisher's avatar on "https://www.npmjs.com"
+     * @example /npm-avatar/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.e30.LwimMJA3puF3ioGeS-tfczR3370GXBZMIL-bdpu4hOU
+     */
+    npmAvatar?: string;
   }
 
   export interface DependencyLinks {