@refentse/gatekeeper-cli 1.0.0

package/index.js

@@ -0,0 +1,65 @@
+#!/usr/bin/env node
+
+import { program } from 'commander';
+import inquirer from 'inquirer';
+import { spawn } from 'child_process';
+import chalk from 'chalk';
+import { checkPackage } from './src/scanner.js'; 
+
+program
+    .version('1.0.0')
+    .description('npm-gatekeeper: Zero-Trust Package Management');
+
+program
+    .command('install <package>')
+    .description('Intercepts and safely installs an npm package')
+    .action(async (packageName) => {
+        
+        // 1. Run Gatekeeper Heuristics
+        const scanResult = await checkPackage(packageName);
+
+        // 2. The Interception Logic
+        if (scanResult.hardBlock) {
+            console.log(chalk.bgRed.white.bold('\n 🚫 HARD BLOCK ACTIVATED. Installation aborted to protect your environment. '));
+            process.exit(1);
+        }
+
+        if (!scanResult.isSafe) {
+            const answers = await inquirer.prompt([
+                {
+                    type: 'confirm',
+                    name: 'override',
+                    message: chalk.red.bold('Threats detected. Do you want to OVERRIDE and install anyway?'),
+                    default: false
+                }
+            ]);
+
+            if (!answers.override) {
+                console.log(chalk.red.bold('\n🚫 Installation blocked by Gatekeeper. Your machine is safe.'));
+                process.exit(1);
+            }
+        }
+
+        // 3. Pass-Through Execution
+        console.log(chalk.cyan(`\n🚀 Handing off to native npm to install ${packageName}...\n`));
+
+        // THE FIX: Explicitly call cmd.exe on Windows to avoid the shell: true warning
+        const isWindows = process.platform === 'win32';
+        const command = isWindows ? 'cmd.exe' : 'npm';
+        const args = isWindows ? ['/c', 'npm', 'install', packageName] : ['install', packageName];
+
+        const child = spawn(command, args, {
+            stdio: 'inherit', 
+            shell: false // Kept false for maximum security
+        });
+
+        child.on('close', (code) => {
+            if (code === 0) {
+                console.log(chalk.green(`\n🔒 gatekeeper: ${packageName} installed successfully.`));
+            } else {
+                console.log(chalk.red(`\n❌ native npm exited with error code ${code}`));
+            }
+        });
+    });
+
+program.parse(process.argv);

package/package.json

@@ -0,0 +1,28 @@
+{
+  "name": "@refentse/gatekeeper-cli",
+  "version": "1.0.0",
+  "description": "Zero-Trust Package Management",
+  "main": "index.js",
+  "type": "module",
+  "bin": {
+    "gatekeeper": "index.js"
+  },
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "keywords": [
+    "security",
+    "zero-trust",
+    "npm",
+    "malware",
+    "osv",
+    "devsecops"
+  ],
+  "author": "Quincy Refentse Moeng",
+  "license": "ISC",
+  "dependencies": {
+    "chalk": "^5.6.2",
+    "commander": "^14.0.3",
+    "inquirer": "^13.3.2"
+  }
+}

package/src/scanner.js

@@ -0,0 +1,71 @@
+import chalk from 'chalk';
+
+export async function checkPackage(packageName) {
+    console.log(chalk.blue(`\n🔍 Gatekeeper is inspecting metadata for: ${packageName}...`));
+    
+    let isSafe = true;
+    let hardBlock = false;
+
+    try {
+        const response = await fetch(`https://registry.npmjs.org/${packageName}`);
+        
+        if (!response.ok) {
+            throw new Error(`Registry returned status ${response.status}`);
+        }
+
+        const fullMetadata = await response.json();
+        const latestVersion = fullMetadata['dist-tags'].latest;
+        const latestData = fullMetadata.versions[latestVersion];
+        const scripts = latestData.scripts || {};
+
+        // 🛡️ CHECK 1: Google OSV Vulnerability Database (HARD BLOCK)
+        console.log(chalk.gray(`   Checking Google OSV database for known vulnerabilities...`));
+        const osvResponse = await fetch('https://api.osv.dev/v1/query', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                version: latestVersion,
+                package: { name: packageName, ecosystem: "npm" }
+            })
+        });
+        
+        if (osvResponse.ok) {
+            const osvData = await osvResponse.json();
+            if (osvData.vulns && osvData.vulns.length > 0) {
+                console.log(chalk.red.bold(`\n🚨 CRITICAL: KNOWN MALWARE DETECTED IN OSV DATABASE 🚨`));
+                console.log(chalk.red(`   Package: ${packageName}@${latestVersion}`));
+                console.log(chalk.red(`   Vulnerabilities found: ${osvData.vulns.length}`));
+                console.log(chalk.red(`   This payload will be hard-blocked. No override permitted.`));
+                return { isSafe: false, hardBlock: true };
+            }
+        }
+
+        // 🚨 CHECK 2: Malicious Lifecycle Scripts
+        if (scripts.postinstall || scripts.preinstall || scripts.install) {
+            console.log(chalk.red.bold(`\n⚠️  WARNING: ${packageName} contains hidden installation scripts.`));
+            console.log(chalk.yellow(`   Script found: ${scripts.postinstall || scripts.preinstall || scripts.install}`));
+            isSafe = false;
+        }
+
+        // 🕒 CHECK 3: Package Age
+        const publishTimeString = fullMetadata.time[latestVersion];
+        const publishTime = new Date(publishTimeString || Date.now()); 
+        const ageInHours = (new Date() - publishTime) / (1000 * 60 * 60);
+        
+        if (ageInHours < 48) {
+            console.log(chalk.yellow(`\n⚠️  NEW PACKAGE ALERT: Version ${latestVersion} was published only ${Math.round(ageInHours)} hours ago.`));
+            isSafe = false;
+        }
+
+        if (isSafe) {
+            console.log(chalk.green(`✅ ${packageName}@${latestVersion} passed heuristics scan. No obvious threats detected.`));
+        }
+
+        return { isSafe, hardBlock }; 
+        
+    } catch (error) {
+        console.error(chalk.red(`\n❌ Could not fetch package data for '${packageName}'.`));
+        console.error(chalk.gray(`   Error details: ${error.message}`));
+        return { isSafe: false, hardBlock: false }; 
+    }
+}