@theoptimalpartner/npm-security-kit 1.0.1 → 1.0.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/CHANGELOG.md +127 -0
  2. package/package.json +2 -1
package/CHANGELOG.md ADDED
@@ -0,0 +1,127 @@
1
+ # Changelog
2
+
3
+ All notable changes to this project will be documented in this file.
4
+
5
+ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
6
+ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
7
+
8
+ ## [Unreleased]
9
+
10
+ ## [1.0.1] - 2025-10-21
11
+
12
+ ### Fixed
13
+ - Corrected template directory paths in `install.sh` to work properly when installed in `node_modules`
14
+ - Changed hardcoded paths from `SCRIPT_DIR/template/` to `SCRIPT_DIR/../template/`
15
+ - Removed fallback references to `auth-service` directory
16
+ - Added proper error messages when template files are not found
17
+
18
+ ### Changed
19
+ - Installation script now properly resolves paths when package is installed as dependency
20
+
21
+ ## [1.0.0] - 2025-10-21
22
+
23
+ ### Added
24
+ - Initial release of NPM Security Kit
25
+ - Blacklist of 175+ known malicious npm packages from Socket.dev October 2025 phishing campaign
26
+ - Pattern matching for malicious package detection (`redirect-*` pattern)
27
+ - Malicious domains and suspicious npm accounts tracking
28
+ - Automated installation script (`install.sh`) for easy project setup
29
+ - CLI tools:
30
+ - `npm-security-install` - Install security infrastructure in projects
31
+ - `npm-security-check` - Quick malicious package check
32
+ - Programmatic API for advanced integration:
33
+ - `loadBlacklist()` - Load malicious packages database
34
+ - `isMalicious(packageName)` - Check if package is in blacklist
35
+ - `matchesMaliciousPattern(packageName)` - Check against malicious patterns
36
+ - Security scripts:
37
+ - `check-malicious-packages.sh` - Verify packages against blacklist
38
+ - `security-check.sh` - Comprehensive security audit (10 checks)
39
+ - GitHub Actions workflow with 6 security jobs:
40
+ - npm audit
41
+ - Socket.dev integration
42
+ - Dependency review
43
+ - License verification
44
+ - Malicious pattern detection
45
+ - Known malicious packages check
46
+ - Dependabot configuration for automated dependency updates
47
+ - Project configuration file (`.security/config.json`)
48
+ - Comprehensive documentation:
49
+ - README.md - Full package documentation
50
+ - QUICK_START.md - 3-minute installation guide
51
+ - EXAMPLES.md - 12 real-world usage scenarios
52
+ - PUBLISHING.md - Guide for package publication
53
+ - Automatic npm scripts injection into `package.json`:
54
+ - `security:check-malicious`
55
+ - `security:check`
56
+ - `security:audit`
57
+ - `security:audit:fix`
58
+ - `security:outdated`
59
+ - `security:licenses`
60
+ - `security:full`
61
+ - SECURITY.md template for projects
62
+ - Support for both new and existing projects
63
+ - Update mode (`--update` flag) to preserve existing configurations
64
+
65
+ ### Security
66
+ - Protection against 175+ known malicious packages
67
+ - Automated weekly security scans via GitHub Actions
68
+ - Pre-deployment security checks
69
+ - Vulnerability detection and auto-fix capabilities
70
+
71
+ ## [0.0.0] - 2025-10-20
72
+
73
+ ### Development
74
+ - Project structure created
75
+ - Template files developed
76
+ - Initial testing in auth-service, jwt-auth-package, and auth-react-client projects
77
+
78
+ ---
79
+
80
+ ## Version History Summary
81
+
82
+ - **1.0.1** - Bug fix for installation paths
83
+ - **1.0.0** - Initial public release
84
+ - **0.0.0** - Development phase
85
+
86
+ ## Upgrade Guide
87
+
88
+ ### From 1.0.0 to 1.0.1
89
+
90
+ No breaking changes. Simply update the package:
91
+
92
+ ```bash
93
+ npm update @theoptimalpartner/npm-security-kit
94
+ ```
95
+
96
+ If you want to refresh your security files:
97
+
98
+ ```bash
99
+ bash ./node_modules/@theoptimalpartner/npm-security-kit/bin/install.sh --update
100
+ ```
101
+
102
+ ## Links
103
+
104
+ - [npm Package](https://www.npmjs.com/package/@theoptimalpartner/npm-security-kit)
105
+ - [Bitbucket Repository](https://bitbucket.org/RoutingUC/npm-security-kit)
106
+ - [Socket.dev - Original Research](https://socket.dev)
107
+
108
+ ## Contributing
109
+
110
+ When making changes that affect the public API or user experience:
111
+
112
+ 1. Update this CHANGELOG.md following Keep a Changelog format
113
+ 2. Categorize changes as:
114
+ - **Added** - New features
115
+ - **Changed** - Changes in existing functionality
116
+ - **Deprecated** - Soon-to-be removed features
117
+ - **Removed** - Removed features
118
+ - **Fixed** - Bug fixes
119
+ - **Security** - Security improvements
120
+ 3. Use semantic versioning:
121
+ - MAJOR - Breaking changes
122
+ - MINOR - New features (backwards compatible)
123
+ - PATCH - Bug fixes (backwards compatible)
124
+
125
+ ## Reporting Issues
126
+
127
+ If you discover a security vulnerability or malicious package not in our blacklist, please report it immediately at the Bitbucket repository issues page.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@theoptimalpartner/npm-security-kit",
3
- "version": "1.0.1",
3
+ "version": "1.0.2",
4
4
  "description": "Portable security kit to protect Node.js/npm projects against malicious packages and vulnerabilities",
5
5
  "main": "src/index.js",
6
6
  "bin": {
@@ -40,6 +40,7 @@
40
40
  "template/",
41
41
  "README.md",
42
42
  "LICENSE",
43
+ "CHANGELOG.md",
43
44
  "QUICK_START.md",
44
45
  "EXAMPLES.md"
45
46
  ],