@theoptimalpartner/npm-security-kit 1.0.0

package/bin/install.sh

@@ -0,0 +1,324 @@
+#!/bin/bash
+
+# NPM Security Kit - Installation Script
+# Installs security infrastructure in any Node.js project
+
+set -e
+
+# Colors
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m' # No Color
+
+# Configuration
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+TARGET_DIR="${1:-.}"
+UPDATE_MODE=false
+
+# Parse arguments
+for arg in "$@"; do
+    case $arg in
+        --update)
+            UPDATE_MODE=true
+            shift
+            ;;
+        --help)
+            echo "Usage: $0 [target-directory] [--update]"
+            echo ""
+            echo "Options:"
+            echo "  target-directory  Directory where to install (default: current directory)"
+            echo "  --update          Update existing installation (preserves config)"
+            echo "  --help            Show this help message"
+            exit 0
+            ;;
+    esac
+done
+
+echo -e "${BLUE}========================================"
+echo "NPM Security Kit - Installation"
+echo -e "========================================${NC}"
+echo ""
+
+# Check if target directory exists
+if [ ! -d "$TARGET_DIR" ]; then
+    echo -e "${RED}✗ Target directory does not exist: $TARGET_DIR${NC}"
+    exit 1
+fi
+
+# Check if it's a Node.js project
+if [ ! -f "$TARGET_DIR/package.json" ]; then
+    echo -e "${YELLOW}⚠ Warning: package.json not found in $TARGET_DIR${NC}"
+    echo -e "${YELLOW}  This might not be a Node.js project.${NC}"
+    read -p "Continue anyway? (y/n) " -n 1 -r
+    echo
+    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
+        exit 1
+    fi
+fi
+
+cd "$TARGET_DIR"
+
+echo -e "${GREEN}✓ Target directory: $(pwd)${NC}"
+echo ""
+
+# Check for required tools
+echo "Checking required tools..."
+MISSING_TOOLS=()
+
+if ! command -v jq &> /dev/null; then
+    MISSING_TOOLS+=("jq")
+fi
+
+if ! command -v npm &> /dev/null; then
+    MISSING_TOOLS+=("npm")
+fi
+
+if [ ${#MISSING_TOOLS[@]} -gt 0 ]; then
+    echo -e "${RED}✗ Missing required tools: ${MISSING_TOOLS[*]}${NC}"
+    echo ""
+    echo "Install them with:"
+    for tool in "${MISSING_TOOLS[@]}"; do
+        case $tool in
+            jq)
+                echo "  - Ubuntu/Debian: sudo apt-get install jq"
+                echo "  - macOS: brew install jq"
+                ;;
+            npm)
+                echo "  - Visit: https://nodejs.org/"
+                ;;
+        esac
+    done
+    exit 1
+fi
+
+echo -e "${GREEN}✓ All required tools available${NC}"
+echo ""
+
+# Create directories
+echo "Creating directory structure..."
+mkdir -p .security
+mkdir -p scripts
+mkdir -p .github/workflows
+
+echo -e "${GREEN}✓ Directories created${NC}"
+echo ""
+
+# Copy security files
+echo "Installing security files..."
+
+# 1. Blacklist
+if [ -f "$SCRIPT_DIR/template/.security/malicious-packages-blacklist.json" ]; then
+    cp "$SCRIPT_DIR/template/.security/malicious-packages-blacklist.json" .security/
+    echo -e "${GREEN}  ✓ Blacklist installed${NC}"
+else
+    # Fallback: copy from auth-service if available
+    if [ -f "$SCRIPT_DIR/../auth-service/.security/malicious-packages-blacklist.json" ]; then
+        cp "$SCRIPT_DIR/../auth-service/.security/malicious-packages-blacklist.json" .security/
+        echo -e "${GREEN}  ✓ Blacklist installed (from auth-service)${NC}"
+    else
+        echo -e "${YELLOW}  ⚠ Blacklist not found, creating empty template${NC}"
+        cat > .security/malicious-packages-blacklist.json <<'EOF'
+{
+  "lastUpdated": "2025-10-20",
+  "source": "Socket.dev",
+  "blacklistedPackages": [],
+  "patterns": [],
+  "maliciousDomains": [],
+  "suspiciousNpmAccounts": []
+}
+EOF
+    fi
+fi
+
+# 2. Config
+if [ "$UPDATE_MODE" = false ] || [ ! -f ".security/config.json" ]; then
+    cat > .security/config.json <<'EOF'
+{
+  "projectName": "my-project",
+  "projectType": "node",
+  "excludeDirs": ["node_modules", "dist", "build", ".next"],
+  "strictMode": true,
+  "notifications": {
+    "enabled": false,
+    "email": "",
+    "slack": ""
+  },
+  "autofix": {
+    "enabled": false,
+    "level": "moderate"
+  }
+}
+EOF
+    echo -e "${GREEN}  ✓ Config created${NC}"
+else
+    echo -e "${BLUE}  → Config preserved (update mode)${NC}"
+fi
+
+# 3. Scripts
+if [ -f "$SCRIPT_DIR/template/scripts/check-malicious-packages.sh" ]; then
+    cp "$SCRIPT_DIR/template/scripts/check-malicious-packages.sh" scripts/
+else
+    cp "$SCRIPT_DIR/../auth-service/scripts/check-malicious-packages.sh" scripts/
+fi
+
+if [ -f "$SCRIPT_DIR/template/scripts/security-check.sh" ]; then
+    cp "$SCRIPT_DIR/template/scripts/security-check.sh" scripts/
+else
+    cp "$SCRIPT_DIR/../auth-service/scripts/security-check.sh" scripts/
+fi
+
+chmod +x scripts/*.sh
+echo -e "${GREEN}  ✓ Scripts installed${NC}"
+
+# 4. GitHub Actions
+if [ -f "$SCRIPT_DIR/template/.github/workflows/security-audit.yml" ]; then
+    cp "$SCRIPT_DIR/template/.github/workflows/security-audit.yml" .github/workflows/
+else
+    cp "$SCRIPT_DIR/../auth-service/.github/workflows/security-audit.yml" .github/workflows/
+fi
+
+echo -e "${GREEN}  ✓ GitHub Actions workflow installed${NC}"
+
+# 5. Dependabot
+if [ -f "$SCRIPT_DIR/template/.github/dependabot.yml" ]; then
+    cp "$SCRIPT_DIR/template/.github/dependabot.yml" .github/
+else
+    cp "$SCRIPT_DIR/../auth-service/.github/dependabot.yml" .github/
+fi
+
+echo -e "${GREEN}  ✓ Dependabot config installed${NC}"
+
+# 6. SECURITY.md
+if [ "$UPDATE_MODE" = false ] || [ ! -f "SECURITY.md" ]; then
+    cat > SECURITY.md <<'EOF'
+# Security Documentation
+
+## Quick Reference
+
+### Security Commands
+
+```bash
+# Check for malicious packages
+npm run security:check-malicious
+
+# Full security audit
+npm run security:full
+
+# npm audit only
+npm run security:audit
+
+# Auto-fix vulnerabilities
+npm run security:audit:fix
+
+# Check outdated packages
+npm run security:outdated
+
+# Verify licenses
+npm run security:licenses
+```
+
+## Current Security Status
+
+**Last Audit**: Run `npm run security:full` to check
+
+## Automated Protection
+
+- ✅ Blacklist of 175+ known malicious packages
+- ✅ GitHub Actions (weekly scans)
+- ✅ Dependabot (automatic updates)
+- ✅ Pre-deployment checks
+
+## Reporting Security Issues
+
+If you discover a security vulnerability, please report it to the security team.
+
+## Resources
+
+- NPM Security Kit: https://github.com/tu-org/npm-security-kit
+- Socket.dev: https://socket.dev
+- npm Security: https://docs.npmjs.com/security
+EOF
+    echo -e "${GREEN}  ✓ SECURITY.md created${NC}"
+else
+    echo -e "${BLUE}  → SECURITY.md preserved (update mode)${NC}"
+fi
+
+echo ""
+
+# Add npm scripts
+echo "Adding npm scripts to package.json..."
+
+if [ -f "package.json" ]; then
+    # Check if scripts already exist
+    if grep -q '"security:check-malicious"' package.json; then
+        echo -e "${BLUE}  → Scripts already exist, skipping${NC}"
+    else
+        # Backup package.json
+        cp package.json package.json.backup
+
+        # Add scripts using jq
+        jq '.scripts += {
+            "security:check": "./scripts/security-check.sh",
+            "security:check-malicious": "./scripts/check-malicious-packages.sh",
+            "security:audit": "npm audit --audit-level=moderate",
+            "security:audit:fix": "npm audit fix",
+            "security:outdated": "npm outdated",
+            "security:licenses": "npm list --json | jq -r '\''.dependencies | to_entries[] | \"\\(.key): \\(.value.license)\"'\''",
+            "security:full": "npm run security:audit && npm run security:check"
+        }' package.json > package.json.tmp
+
+        mv package.json.tmp package.json
+        echo -e "${GREEN}  ✓ Scripts added to package.json${NC}"
+        echo -e "${BLUE}  → Backup saved as package.json.backup${NC}"
+    fi
+else
+    echo -e "${YELLOW}  ⚠ package.json not found, skipping script installation${NC}"
+fi
+
+echo ""
+
+# Run initial check
+echo "Running initial security check..."
+if npm run security:check-malicious > /dev/null 2>&1; then
+    echo -e "${GREEN}✓ Initial check passed - No malicious packages detected${NC}"
+else
+    echo -e "${YELLOW}⚠ Check completed with warnings${NC}"
+fi
+
+echo ""
+echo -e "${BLUE}========================================"
+echo "Installation Complete!"
+echo -e "========================================${NC}"
+echo ""
+echo "Files installed:"
+echo "  ✓ .security/malicious-packages-blacklist.json"
+echo "  ✓ .security/config.json"
+echo "  ✓ scripts/check-malicious-packages.sh"
+echo "  ✓ scripts/security-check.sh"
+echo "  ✓ .github/workflows/security-audit.yml"
+echo "  ✓ .github/dependabot.yml"
+echo "  ✓ SECURITY.md"
+echo "  ✓ package.json (scripts added)"
+echo ""
+echo "Next steps:"
+echo ""
+echo "  1. Verify installation:"
+echo "     npm run security:check-malicious"
+echo ""
+echo "  2. Run full audit:"
+echo "     npm run security:full"
+echo ""
+echo "  3. Customize config:"
+echo "     Edit .security/config.json"
+echo ""
+echo "  4. Commit files:"
+echo "     git add .security scripts .github SECURITY.md package.json"
+echo "     git commit -m \"security: add npm security kit\""
+echo ""
+echo "  5. Push to enable GitHub Actions:"
+echo "     git push"
+echo ""
+echo -e "${GREEN}Your project is now protected!${NC} 🛡️"
+echo ""

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "@theoptimalpartner/npm-security-kit",
+  "version": "1.0.0",
+  "description": "Portable security kit to protect Node.js/npm projects against malicious packages and vulnerabilities",
+  "main": "src/index.js",
+  "bin": {
+    "npm-security-install": "./bin/install.js",
+    "npm-security-check": "./bin/check.js"
+  },
+  "scripts": {
+    "test": "echo \"No tests specified - package verified with npm pack\"",
+    "prepare": "chmod +x bin/*.js"
+  },
+  "keywords": [
+    "security",
+    "npm",
+    "malicious-packages",
+    "supply-chain",
+    "vulnerability",
+    "audit",
+    "phishing",
+    "typosquatting",
+    "socket.dev",
+    "dependabot",
+    "github-actions"
+  ],
+  "author": "The Optimal",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://bitbucket.org/RoutingUC/npm-security-kit.git"
+  },
+  "engines": {
+    "node": ">=14.0.0",
+    "npm": ">=6.0.0"
+  },
+  "files": [
+    "bin/",
+    "src/",
+    "template/",
+    "README.md",
+    "LICENSE",
+    "QUICK_START.md",
+    "EXAMPLES.md"
+  ],
+  "dependencies": {},
+  "devDependencies": {},
+  "peerDependencies": {},
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/index.js

@@ -0,0 +1,71 @@
+/**
+ * NPM Security Kit
+ * Main entry point for programmatic usage
+ */
+
+const path = require('path');
+const fs = require('fs');
+
+/**
+ * Get path to template files
+ */
+function getTemplatePath() {
+  return path.join(__dirname, '..', 'template');
+}
+
+/**
+ * Get path to blacklist file
+ */
+function getBlacklistPath() {
+  return path.join(getTemplatePath(), '.security', 'malicious-packages-blacklist.json');
+}
+
+/**
+ * Load malicious packages blacklist
+ */
+function loadBlacklist() {
+  const blacklistPath = getBlacklistPath();
+  if (!fs.existsSync(blacklistPath)) {
+    throw new Error('Blacklist file not found');
+  }
+  return JSON.parse(fs.readFileSync(blacklistPath, 'utf8'));
+}
+
+/**
+ * Check if a package is in the blacklist
+ * @param {string} packageName - Name of the package to check
+ * @returns {boolean} - True if package is malicious
+ */
+function isMalicious(packageName) {
+  const blacklist = loadBlacklist();
+  return blacklist.blacklistedPackages.includes(packageName);
+}
+
+/**
+ * Check if a package matches malicious patterns
+ * @param {string} packageName - Name of the package to check
+ * @returns {boolean} - True if package matches a malicious pattern
+ */
+function matchesMaliciousPattern(packageName) {
+  const blacklist = loadBlacklist();
+  return blacklist.patterns.some(p => {
+    const regex = new RegExp(p.pattern);
+    return regex.test(packageName);
+  });
+}
+
+/**
+ * Get installation path
+ */
+function getInstallPath() {
+  return path.join(__dirname, '..', 'bin', 'install.sh');
+}
+
+module.exports = {
+  getTemplatePath,
+  getBlacklistPath,
+  loadBlacklist,
+  isMalicious,
+  matchesMaliciousPattern,
+  getInstallPath
+};

package/template/.github/dependabot.yml

@@ -0,0 +1,63 @@
+version: 2
+updates:
+  # Enable version updates for npm dependencies
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+    # Limit the number of open pull requests
+    open-pull-requests-limit: 10
+    # Add reviewers
+    reviewers:
+      - "diego"
+    # Add labels
+    labels:
+      - "dependencies"
+      - "security"
+      - "automerge-candidate"
+    # Group updates
+    groups:
+      aws-sdk:
+        patterns:
+          - "@aws-sdk/*"
+      typescript:
+        patterns:
+          - "typescript"
+          - "@types/*"
+          - "ts-node"
+          - "tsx"
+      testing:
+        patterns:
+          - "jest"
+          - "@types/jest"
+          - "c8"
+      serverless:
+        patterns:
+          - "serverless*"
+    # Security updates configuration
+    versioning-strategy: increase
+    # Allow both direct and indirect updates
+    allow:
+      - dependency-type: "all"
+    # Ignore major version updates for now (require manual review)
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    # Automatically rebase PRs
+    rebase-strategy: "auto"
+    # Commit message prefix
+    commit-message:
+      prefix: "chore"
+      prefix-development: "chore(dev)"
+      include: "scope"
+
+  # Monitor GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    labels:
+      - "ci"
+      - "security"