@theoptimalpartner/npm-security-kit 1.0.0 → 1.0.2

package/CHANGELOG.md

@@ -0,0 +1,127 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [1.0.1] - 2025-10-21
+
+### Fixed
+- Corrected template directory paths in `install.sh` to work properly when installed in `node_modules`
+- Changed hardcoded paths from `SCRIPT_DIR/template/` to `SCRIPT_DIR/../template/`
+- Removed fallback references to `auth-service` directory
+- Added proper error messages when template files are not found
+
+### Changed
+- Installation script now properly resolves paths when package is installed as dependency
+
+## [1.0.0] - 2025-10-21
+
+### Added
+- Initial release of NPM Security Kit
+- Blacklist of 175+ known malicious npm packages from Socket.dev October 2025 phishing campaign
+- Pattern matching for malicious package detection (`redirect-*` pattern)
+- Malicious domains and suspicious npm accounts tracking
+- Automated installation script (`install.sh`) for easy project setup
+- CLI tools:
+  - `npm-security-install` - Install security infrastructure in projects
+  - `npm-security-check` - Quick malicious package check
+- Programmatic API for advanced integration:
+  - `loadBlacklist()` - Load malicious packages database
+  - `isMalicious(packageName)` - Check if package is in blacklist
+  - `matchesMaliciousPattern(packageName)` - Check against malicious patterns
+- Security scripts:
+  - `check-malicious-packages.sh` - Verify packages against blacklist
+  - `security-check.sh` - Comprehensive security audit (10 checks)
+- GitHub Actions workflow with 6 security jobs:
+  - npm audit
+  - Socket.dev integration
+  - Dependency review
+  - License verification
+  - Malicious pattern detection
+  - Known malicious packages check
+- Dependabot configuration for automated dependency updates
+- Project configuration file (`.security/config.json`)
+- Comprehensive documentation:
+  - README.md - Full package documentation
+  - QUICK_START.md - 3-minute installation guide
+  - EXAMPLES.md - 12 real-world usage scenarios
+  - PUBLISHING.md - Guide for package publication
+- Automatic npm scripts injection into `package.json`:
+  - `security:check-malicious`
+  - `security:check`
+  - `security:audit`
+  - `security:audit:fix`
+  - `security:outdated`
+  - `security:licenses`
+  - `security:full`
+- SECURITY.md template for projects
+- Support for both new and existing projects
+- Update mode (`--update` flag) to preserve existing configurations
+
+### Security
+- Protection against 175+ known malicious packages
+- Automated weekly security scans via GitHub Actions
+- Pre-deployment security checks
+- Vulnerability detection and auto-fix capabilities
+
+## [0.0.0] - 2025-10-20
+
+### Development
+- Project structure created
+- Template files developed
+- Initial testing in auth-service, jwt-auth-package, and auth-react-client projects
+
+---
+
+## Version History Summary
+
+- **1.0.1** - Bug fix for installation paths
+- **1.0.0** - Initial public release
+- **0.0.0** - Development phase
+
+## Upgrade Guide
+
+### From 1.0.0 to 1.0.1
+
+No breaking changes. Simply update the package:
+
+```bash
+npm update @theoptimalpartner/npm-security-kit
+```
+
+If you want to refresh your security files:
+
+```bash
+bash ./node_modules/@theoptimalpartner/npm-security-kit/bin/install.sh --update
+```
+
+## Links
+
+- [npm Package](https://www.npmjs.com/package/@theoptimalpartner/npm-security-kit)
+- [Bitbucket Repository](https://bitbucket.org/RoutingUC/npm-security-kit)
+- [Socket.dev - Original Research](https://socket.dev)
+
+## Contributing
+
+When making changes that affect the public API or user experience:
+
+1. Update this CHANGELOG.md following Keep a Changelog format
+2. Categorize changes as:
+   - **Added** - New features
+   - **Changed** - Changes in existing functionality
+   - **Deprecated** - Soon-to-be removed features
+   - **Removed** - Removed features
+   - **Fixed** - Bug fixes
+   - **Security** - Security improvements
+3. Use semantic versioning:
+   - MAJOR - Breaking changes
+   - MINOR - New features (backwards compatible)
+   - PATCH - Bug fixes (backwards compatible)
+
+## Reporting Issues
+
+If you discover a security vulnerability or malicious package not in our blacklist, please report it immediately at the Bitbucket repository issues page.

package/bin/install.sh

@@ -108,28 +108,17 @@ echo ""
 # Copy security files
 echo "Installing security files..."
 
+# Template directory
+TEMPLATE_DIR="$SCRIPT_DIR/../template"
+
 # 1. Blacklist
-if [ -f "$SCRIPT_DIR/template/.security/malicious-packages-blacklist.json" ]; then
-    cp "$SCRIPT_DIR/template/.security/malicious-packages-blacklist.json" .security/
+if [ -f "$TEMPLATE_DIR/.security/malicious-packages-blacklist.json" ]; then
+    cp "$TEMPLATE_DIR/.security/malicious-packages-blacklist.json" .security/
     echo -e "${GREEN}  ✓ Blacklist installed${NC}"
 else
-    # Fallback: copy from auth-service if available
-    if [ -f "$SCRIPT_DIR/../auth-service/.security/malicious-packages-blacklist.json" ]; then
-        cp "$SCRIPT_DIR/../auth-service/.security/malicious-packages-blacklist.json" .security/
-        echo -e "${GREEN}  ✓ Blacklist installed (from auth-service)${NC}"
-    else
-        echo -e "${YELLOW}  ⚠ Blacklist not found, creating empty template${NC}"
-        cat > .security/malicious-packages-blacklist.json <<'EOF'
-{
-  "lastUpdated": "2025-10-20",
-  "source": "Socket.dev",
-  "blacklistedPackages": [],
-  "patterns": [],
-  "maliciousDomains": [],
-  "suspiciousNpmAccounts": []
-}
-EOF
-    fi
+    echo -e "${RED}  ✗ Error: Blacklist template not found${NC}"
+    echo -e "${YELLOW}  Expected: $TEMPLATE_DIR/.security/malicious-packages-blacklist.json${NC}"
+    exit 1
 fi
 
 # 2. Config
@@ -157,35 +146,40 @@ else
 fi
 
 # 3. Scripts
-if [ -f "$SCRIPT_DIR/template/scripts/check-malicious-packages.sh" ]; then
-    cp "$SCRIPT_DIR/template/scripts/check-malicious-packages.sh" scripts/
+if [ -f "$TEMPLATE_DIR/scripts/check-malicious-packages.sh" ]; then
+    cp "$TEMPLATE_DIR/scripts/check-malicious-packages.sh" scripts/
+    chmod +x scripts/check-malicious-packages.sh
 else
-    cp "$SCRIPT_DIR/../auth-service/scripts/check-malicious-packages.sh" scripts/
+    echo -e "${RED}  ✗ Error: check-malicious-packages.sh not found${NC}"
+    exit 1
 fi
 
-if [ -f "$SCRIPT_DIR/template/scripts/security-check.sh" ]; then
-    cp "$SCRIPT_DIR/template/scripts/security-check.sh" scripts/
+if [ -f "$TEMPLATE_DIR/scripts/security-check.sh" ]; then
+    cp "$TEMPLATE_DIR/scripts/security-check.sh" scripts/
+    chmod +x scripts/security-check.sh
 else
-    cp "$SCRIPT_DIR/../auth-service/scripts/security-check.sh" scripts/
+    echo -e "${RED}  ✗ Error: security-check.sh not found${NC}"
+    exit 1
 fi
 
-chmod +x scripts/*.sh
 echo -e "${GREEN}  ✓ Scripts installed${NC}"
 
 # 4. GitHub Actions
-if [ -f "$SCRIPT_DIR/template/.github/workflows/security-audit.yml" ]; then
-    cp "$SCRIPT_DIR/template/.github/workflows/security-audit.yml" .github/workflows/
+if [ -f "$TEMPLATE_DIR/.github/workflows/security-audit.yml" ]; then
+    cp "$TEMPLATE_DIR/.github/workflows/security-audit.yml" .github/workflows/
 else
-    cp "$SCRIPT_DIR/../auth-service/.github/workflows/security-audit.yml" .github/workflows/
+    echo -e "${RED}  ✗ Error: security-audit.yml not found${NC}"
+    exit 1
 fi
 
 echo -e "${GREEN}  ✓ GitHub Actions workflow installed${NC}"
 
 # 5. Dependabot
-if [ -f "$SCRIPT_DIR/template/.github/dependabot.yml" ]; then
-    cp "$SCRIPT_DIR/template/.github/dependabot.yml" .github/
+if [ -f "$TEMPLATE_DIR/.github/dependabot.yml" ]; then
+    cp "$TEMPLATE_DIR/.github/dependabot.yml" .github/
 else
-    cp "$SCRIPT_DIR/../auth-service/.github/dependabot.yml" .github/
+    echo -e "${RED}  ✗ Error: dependabot.yml not found${NC}"
+    exit 1
 fi
 
 echo -e "${GREEN}  ✓ Dependabot config installed${NC}"

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@theoptimalpartner/npm-security-kit",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Portable security kit to protect Node.js/npm projects against malicious packages and vulnerabilities",
   "main": "src/index.js",
   "bin": {
-    "npm-security-install": "./bin/install.js",
-    "npm-security-check": "./bin/check.js"
+    "npm-security-install": "bin/install.js",
+    "npm-security-check": "bin/check.js"
   },
   "scripts": {
     "test": "echo \"No tests specified - package verified with npm pack\"",
@@ -28,7 +28,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://bitbucket.org/RoutingUC/npm-security-kit.git"
+    "url": "git+https://bitbucket.org/RoutingUC/npm-security-kit.git"
   },
   "engines": {
     "node": ">=14.0.0",
@@ -40,6 +40,7 @@
     "template/",
     "README.md",
     "LICENSE",
+    "CHANGELOG.md",
     "QUICK_START.md",
     "EXAMPLES.md"
   ],