@orangemug/oops 0.1.1

package/README.md

@@ -0,0 +1,26 @@
+# `@orangemug/oops`
+Have I got a compromised pacakge in my npm/pnpm/yarn cache?
+
+## Usage
+Find out with `oops`
+
+```bash
+npx @orangemug/oops --help
+# ./oops <dangerous_package_versions>
+# 
+# Example: npx @orangemug/oops @ctrl/tinycolor:4.1.1 @ctrl/tinycolor:4.1.2
+```
+
+You can attach this command to a bug tracker ticket somewhere in your company/organisation
+
+> Check for compromised packages with
+>
+> ```bash
+> npx @orangemug/oops \
+>   @ctrl/tinycolor:4.1.1 \
+>   @ctrl/tinycolor:4.1.2
+> ``` 
+
+
+## Licence
+MIT

package/dist/npm/bin/index.js

@@ -0,0 +1,100 @@
+#!/usr/bin/env node
+import chalk from 'chalk';
+import { exec as exec$1 } from 'child_process';
+import { promisify } from 'util';
+import semver from 'semver';
+import minimist from 'minimist';
+
+const exec = promisify(exec$1);
+async function pnpmDoesPackageExist(pkgName) {
+    var _a;
+    const result = await exec(`pnpm cache view ${pkgName}`);
+    const obj = JSON.parse(result.stdout);
+    for (const [_registry, data] of Object.entries(obj)) {
+        return (_a = data.cachedVersions) !== null && _a !== void 0 ? _a : [];
+    }
+    return [];
+}
+async function npmDoesPackageExist(pkgName) {
+    const result = await exec(`npm cache ls ${pkgName}`);
+    const out = [];
+    for (const line of result.stdout.split("\n")) {
+        const matches = line.match(/\/(.*)-(.*)\.tgz$/);
+        if (matches) {
+            out.push(matches[2]);
+        }
+    }
+    return out;
+}
+async function yarnDoesPackageExist(pkgName) {
+    const result = await exec(`yarn cache list --pattern ${pkgName}`);
+    const items = result.stdout.split("\n").map(line => line.split(/\s+/));
+    const out = [];
+    for (const item of items) {
+        if (item[0] === pkgName) {
+            out.push(item[1]);
+        }
+    }
+    return out;
+}
+async function doesPackageExistInCache(pkgName, version) {
+    if (!semver.valid(version)) {
+        throw new Error(`Invalid version range "${version}"`);
+    }
+    const effectedVersions = {};
+    for (const [managerName, pkgVersions] of [
+        ["npm", await npmDoesPackageExist(pkgName)],
+        ["pnpm", await pnpmDoesPackageExist(pkgName)],
+        ["yarn", await yarnDoesPackageExist(pkgName)],
+    ]) {
+        const sorted = pkgVersions.sort((v1, v2) => {
+            if (semver.lt(v1, v2)) {
+                return -1;
+            }
+            else if (semver.gt(v1, v2)) {
+                return 1;
+            }
+            return 0;
+        });
+        const filteredVersions = sorted.filter(pkgVersion => {
+            return semver.satisfies(pkgVersion, version);
+        });
+        effectedVersions[managerName] = filteredVersions;
+    }
+    return effectedVersions;
+}
+
+async function run(packages) {
+    let hasErrors = false;
+    for (const pkg of packages) {
+        const [pkgName, version] = pkg.split(":");
+        if (pkgName && version) {
+            const output = await doesPackageExistInCache(pkgName, version);
+            console.log(`${chalk.magenta(pkgName)}:${version}`);
+            for (const [manager, versions] of Object.entries(output)) {
+                if (versions.length > 0) {
+                    hasErrors = true;
+                    console.log(` - ${manager}`);
+                    for (const version of versions) {
+                        console.log(`    * ${chalk.red(version)}`);
+                    }
+                }
+                else {
+                    console.log(` - ${manager}: none`);
+                }
+            }
+        }
+    }
+    process.exit(hasErrors ? 1 : 0);
+}
+const HELP_TEXT = `
+./oops <dangerous_package_versions>
+
+Example: ./oops @ctrl/tinycolor:4.1.1 @ctrl/tinycolor:4.1.2
+`.trim();
+const argv = minimist(process.argv.slice(2));
+if (argv._.length < 1 && argv.help || argv.h) {
+    console.log(HELP_TEXT);
+    process.exit(0);
+}
+await run(argv._);

package/dist/npm/cjs/index.js

@@ -0,0 +1,66 @@
+'use strict';
+
+var child_process = require('child_process');
+var util = require('util');
+var semver = require('semver');
+
+const exec = util.promisify(child_process.exec);
+async function pnpmDoesPackageExist(pkgName) {
+    var _a;
+    const result = await exec(`pnpm cache view ${pkgName}`);
+    const obj = JSON.parse(result.stdout);
+    for (const [_registry, data] of Object.entries(obj)) {
+        return (_a = data.cachedVersions) !== null && _a !== void 0 ? _a : [];
+    }
+    return [];
+}
+async function npmDoesPackageExist(pkgName) {
+    const result = await exec(`npm cache ls ${pkgName}`);
+    const out = [];
+    for (const line of result.stdout.split("\n")) {
+        const matches = line.match(/\/(.*)-(.*)\.tgz$/);
+        if (matches) {
+            out.push(matches[2]);
+        }
+    }
+    return out;
+}
+async function yarnDoesPackageExist(pkgName) {
+    const result = await exec(`yarn cache list --pattern ${pkgName}`);
+    const items = result.stdout.split("\n").map(line => line.split(/\s+/));
+    const out = [];
+    for (const item of items) {
+        if (item[0] === pkgName) {
+            out.push(item[1]);
+        }
+    }
+    return out;
+}
+async function doesPackageExistInCache(pkgName, version) {
+    if (!semver.valid(version)) {
+        throw new Error(`Invalid version range "${version}"`);
+    }
+    const effectedVersions = {};
+    for (const [managerName, pkgVersions] of [
+        ["npm", await npmDoesPackageExist(pkgName)],
+        ["pnpm", await pnpmDoesPackageExist(pkgName)],
+        ["yarn", await yarnDoesPackageExist(pkgName)],
+    ]) {
+        const sorted = pkgVersions.sort((v1, v2) => {
+            if (semver.lt(v1, v2)) {
+                return -1;
+            }
+            else if (semver.gt(v1, v2)) {
+                return 1;
+            }
+            return 0;
+        });
+        const filteredVersions = sorted.filter(pkgVersion => {
+            return semver.satisfies(pkgVersion, version);
+        });
+        effectedVersions[managerName] = filteredVersions;
+    }
+    return effectedVersions;
+}
+
+exports.doesPackageExistInCache = doesPackageExistInCache;

package/dist/npm/cjs/types.d.ts

@@ -0,0 +1,3 @@
+declare function doesPackageExistInCache(pkgName: string, version: string): Promise<Record<string, string[]>>;
+
+export { doesPackageExistInCache };

package/dist/npm/es/index.js

@@ -0,0 +1,64 @@
+import { exec as exec$1 } from 'child_process';
+import { promisify } from 'util';
+import semver from 'semver';
+
+const exec = promisify(exec$1);
+async function pnpmDoesPackageExist(pkgName) {
+    var _a;
+    const result = await exec(`pnpm cache view ${pkgName}`);
+    const obj = JSON.parse(result.stdout);
+    for (const [_registry, data] of Object.entries(obj)) {
+        return (_a = data.cachedVersions) !== null && _a !== void 0 ? _a : [];
+    }
+    return [];
+}
+async function npmDoesPackageExist(pkgName) {
+    const result = await exec(`npm cache ls ${pkgName}`);
+    const out = [];
+    for (const line of result.stdout.split("\n")) {
+        const matches = line.match(/\/(.*)-(.*)\.tgz$/);
+        if (matches) {
+            out.push(matches[2]);
+        }
+    }
+    return out;
+}
+async function yarnDoesPackageExist(pkgName) {
+    const result = await exec(`yarn cache list --pattern ${pkgName}`);
+    const items = result.stdout.split("\n").map(line => line.split(/\s+/));
+    const out = [];
+    for (const item of items) {
+        if (item[0] === pkgName) {
+            out.push(item[1]);
+        }
+    }
+    return out;
+}
+async function doesPackageExistInCache(pkgName, version) {
+    if (!semver.valid(version)) {
+        throw new Error(`Invalid version range "${version}"`);
+    }
+    const effectedVersions = {};
+    for (const [managerName, pkgVersions] of [
+        ["npm", await npmDoesPackageExist(pkgName)],
+        ["pnpm", await pnpmDoesPackageExist(pkgName)],
+        ["yarn", await yarnDoesPackageExist(pkgName)],
+    ]) {
+        const sorted = pkgVersions.sort((v1, v2) => {
+            if (semver.lt(v1, v2)) {
+                return -1;
+            }
+            else if (semver.gt(v1, v2)) {
+                return 1;
+            }
+            return 0;
+        });
+        const filteredVersions = sorted.filter(pkgVersion => {
+            return semver.satisfies(pkgVersion, version);
+        });
+        effectedVersions[managerName] = filteredVersions;
+    }
+    return effectedVersions;
+}
+
+export { doesPackageExistInCache };

package/dist/npm/es/types.d.ts

@@ -0,0 +1,3 @@
+declare function doesPackageExistInCache(pkgName: string, version: string): Promise<Record<string, string[]>>;
+
+export { doesPackageExistInCache };

package/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "@orangemug/oops",
+  "description": "Have I got a compromised pacakge in my cache?",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/orangemug/oops"
+  },
+  "type": "module",
+  "scripts": {
+    "lint": "npx prettier . --check",
+    "test": "vitest run --coverage",
+    "test:ci": "vitest run --coverage --reporter=junit --outputFile=test-report.junit.xml",
+    "lint:format": "npx prettier . --write",
+    "build": "rollup -c rollup.config.ts && chmod +x dist/npm/bin/index.js"
+  },
+  "bin": "./dist/npm/bin/index.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "default": "./dist/npm/es/index.js",
+        "types": "./dist/npm/es/types.d.ts"
+      },
+      "require": {
+        "default": "./dist/npm/cjs/index.js",
+        "types": "./dist/npm/cjs/types.d.ts"
+      }
+    }
+  },
+  "files": [
+    "./dist/npm",
+    "./package.json",
+    "./README.md"
+  ],
+  "devDependencies": {
+    "@rollup/plugin-typescript": "^12.3.0",
+    "@tsconfig/node22": "^22.0.5",
+    "@types/minimist": "^1.2.5",
+    "@types/node": "^25.3.5",
+    "@types/semver": "^7.7.1",
+    "@types/yargs": "^17.0.35",
+    "@vitest/coverage-v8": "^4.1.2",
+    "prettier": "^3.8.1",
+    "rollup-plugin-dts": "^6.4.1",
+    "rollup-plugin-typescript-paths": "^1.5.0",
+    "tslib": "^2.8.1",
+    "tsx": "^4.21.0",
+    "vitest": "^4.0.18"
+  },
+  "dependencies": {
+    "chalk": "^5.6.2",
+    "minimist": "^1.2.8",
+    "semver": "^7.7.4"
+  },
+  "version": "0.1.1"
+}