@theoptimalpartner/npm-security-kit 1.0.2 → 2.0.0-beta.0

package/QUICK_START.md

@@ -1,291 +0,0 @@
-# Quick Start Guide - NPM Security Kit
-
-## 3 Minutos para Proteger tu Proyecto
-
----
-
-## Para Proyectos Existentes
-
-### Opción A: Instalación Automática (Más Fácil)
-
-```bash
-# 1. Ir a tu proyecto
-cd /ruta/a/tu-proyecto
-
-# 2. Ejecutar instalación
-bash /home/diego/projects/npm-security-kit/install.sh
-
-# 3. Verificar
-npm run security:check-malicious
-
-# ¡Listo!
-```
-
-### Opción B: Instalación Manual
-
-```bash
-# 1. Copiar archivos
-cp -r /home/diego/projects/npm-security-kit/template/.security tu-proyecto/
-cp -r /home/diego/projects/npm-security-kit/template/scripts tu-proyecto/
-cp -r /home/diego/projects/npm-security-kit/template/.github tu-proyecto/
-
-# 2. Hacer ejecutables
-cd tu-proyecto
-chmod +x scripts/*.sh
-
-# 3. Agregar a package.json (ver abajo)
-```
-
-**Scripts para agregar a package.json**:
-
-```json
-{
-  "scripts": {
-    "security:check": "./scripts/security-check.sh",
-    "security:check-malicious": "./scripts/check-malicious-packages.sh",
-    "security:audit": "npm audit --audit-level=moderate",
-    "security:audit:fix": "npm audit fix",
-    "security:outdated": "npm outdated",
-    "security:licenses": "npm list --json | jq -r '.dependencies | to_entries[] | \"\\(.key): \\(.value.license)\"'",
-    "security:full": "npm run security:audit && npm run security:check"
-  }
-}
-```
-
----
-
-## Para Proyectos Nuevos
-
-### Desde el Inicio
-
-```bash
-# 1. Crear proyecto
-mkdir mi-nuevo-proyecto
-cd mi-nuevo-proyecto
-npm init -y
-
-# 2. Instalar security kit
-bash /home/diego/projects/npm-security-kit/install.sh
-
-# 3. Instalar dependencias
-npm install
-
-# 4. Verificar
-npm run security:check-malicious
-
-# Ahora tu proyecto nace protegido!
-```
-
----
-
-## Uso Diario
-
-### Antes de Instalar un Paquete
-
-```bash
-# Ver info del paquete
-npm info nombre-paquete
-
-# Instalar
-npm install nombre-paquete
-
-# Verificar inmediatamente
-npm run security:check-malicious
-```
-
-### Antes de Hacer Deploy
-
-```bash
-npm run security:full
-```
-
-### Si Hay Problemas
-
-```bash
-# Auto-fix
-npm run security:audit:fix
-
-# Verificar de nuevo
-npm run security:full
-```
-
----
-
-## Comandos Importantes
-
-| Comando | Cuándo Usarlo | Frecuencia |
-|---------|---------------|------------|
-| `npm run security:check-malicious` | Después de instalar paquetes | Cada instalación |
-| `npm run security:audit` | Verificar vulnerabilidades | Diario |
-| `npm run security:full` | Antes de deploy | Pre-deploy |
-| `npm run security:audit:fix` | Cuando hay vulnerabilidades | Según necesidad |
-| `npm run security:outdated` | Ver actualizaciones | Semanal |
-
----
-
-## Configuración Rápida
-
-### Editar `.security/config.json`
-
-```json
-{
-  "projectName": "mi-proyecto",          // Nombre de tu proyecto
-  "projectType": "react",                 // node, react, nextjs, etc.
-  "strictMode": true                      // Bloquear en CI si hay amenazas
-}
-```
-
-### Tipos de Proyecto
-
-- `node` - Backend Node.js
-- `react` - React app
-- `nextjs` - Next.js
-- `vue` - Vue.js
-- `express` - Express API
-- `serverless` - Lambdas
-- `library` - npm package
-
----
-
-## GitHub Actions (Automático)
-
-Una vez que hagas push, GitHub Actions ejecutará:
-
-- ✅ Verificación en cada PR
-- ✅ Verificación en cada push
-- ✅ Scan semanal automático (Lunes 9am)
-
-No necesitas hacer nada más!
-
----
-
-## Dependabot (Automático)
-
-Dependabot abrirá PRs automáticos para:
-
-- ✅ Security patches
-- ✅ Actualizaciones de dependencias
-- ✅ Agrupadas por categoría
-
-Revisa y aprueba semanalmente.
-
----
-
-## Verificar que Todo Funciona
-
-```bash
-# 1. Verificar blacklist
-ls -la .security/malicious-packages-blacklist.json
-
-# 2. Verificar scripts
-ls -la scripts/*.sh
-./scripts/check-malicious-packages.sh
-
-# 3. Verificar GitHub Actions
-ls -la .github/workflows/security-audit.yml
-
-# 4. Verificar scripts npm
-npm run security:check-malicious
-
-# Si todo sale ✓ estás listo!
-```
-
----
-
-## Problemas Comunes
-
-### "jq: command not found"
-
-```bash
-# Ubuntu/Debian
-sudo apt-get install jq
-
-# macOS
-brew install jq
-```
-
-### "Permission denied"
-
-```bash
-chmod +x scripts/*.sh
-```
-
-### Scripts npm no funcionan
-
-Asegúrate de que package.json tenga los scripts. Verifica con:
-
-```bash
-cat package.json | grep security
-```
-
----
-
-## Próximos Pasos
-
-1. ✅ Instalar en proyecto actual
-2. ✅ Ejecutar `npm run security:full`
-3. ✅ Arreglar cualquier problema
-4. ✅ Commit y push
-5. ✅ Verificar GitHub Actions
-6. ✅ Configurar Dependabot
-7. ✅ Repetir en otros proyectos!
-
----
-
-## ¿Necesitas Ayuda?
-
-- **Documentación completa**: `README.md`
-- **Configuración avanzada**: `.security/config.json`
-- **Issues**: GitHub Issues
-- **Email**: security@tuempresa.com
-
----
-
-## Ejemplos Reales
-
-### Proyecto Backend (Express)
-
-```bash
-cd mi-api-express
-bash /home/diego/projects/npm-security-kit/install.sh
-npm run security:check-malicious
-# ✓ No malicious packages detected
-```
-
-### Proyecto Frontend (React)
-
-```bash
-cd mi-app-react
-bash /home/diego/projects/npm-security-kit/install.sh
-npm run security:check-malicious
-# ✓ No malicious packages detected
-```
-
-### Librería npm
-
-```bash
-cd mi-libreria
-bash /home/diego/projects/npm-security-kit/install.sh
-npm run security:check-malicious
-# ✓ No malicious packages detected
-```
-
----
-
-## Checklist de Instalación
-
-- [ ] Ejecutar `install.sh`
-- [ ] Verificar archivos creados (`.security`, `scripts`, `.github`)
-- [ ] Probar `npm run security:check-malicious`
-- [ ] Probar `npm run security:full`
-- [ ] Personalizar `.security/config.json`
-- [ ] Commit archivos a git
-- [ ] Push para activar GitHub Actions
-- [ ] Verificar que Dependabot esté activo
-- [ ] Documentar para el equipo
-
----
-
-**¡Tu proyecto está protegido!** 🛡️
-
-Repite este proceso en todos tus proyectos para mantener tu código seguro.

package/bin/check.js

@@ -1,30 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * NPM Security Kit - Quick Check Tool
- * Runs malicious package check in current project
- */
-
-const { execSync } = require('child_process');
-const path = require('path');
-const fs = require('fs');
-
-const targetDir = process.cwd();
-const checkScript = path.join(targetDir, 'scripts', 'check-malicious-packages.sh');
-
-// Check if scripts are installed
-if (!fs.existsSync(checkScript)) {
-  console.error('Error: NPM Security Kit not installed in this project');
-  console.error('Run: npx @yourorg/npm-security-kit install');
-  process.exit(1);
-}
-
-try {
-  // Execute check script
-  execSync(`bash "${checkScript}"`, {
-    stdio: 'inherit',
-    cwd: targetDir
-  });
-} catch (error) {
-  process.exit(error.status || 1);
-}

package/bin/install.js

@@ -1,36 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * NPM Security Kit - CLI Installation Tool
- * Installs security infrastructure in any Node.js project
- */
-
-const { execSync } = require('child_process');
-const path = require('path');
-const fs = require('fs');
-
-const installScript = path.join(__dirname, 'install.sh');
-
-// Check if install.sh exists
-if (!fs.existsSync(installScript)) {
-  console.error('Error: install.sh not found');
-  process.exit(1);
-}
-
-// Get target directory from arguments or use current directory
-const targetDir = process.argv[2] || process.cwd();
-
-// Build command
-const args = process.argv.slice(2).join(' ');
-const command = `bash "${installScript}" ${args}`;
-
-try {
-  // Execute install script
-  execSync(command, {
-    stdio: 'inherit',
-    cwd: targetDir
-  });
-} catch (error) {
-  console.error('Installation failed:', error.message);
-  process.exit(1);
-}

package/bin/install.sh

@@ -1,318 +0,0 @@
-#!/bin/bash
-
-# NPM Security Kit - Installation Script
-# Installs security infrastructure in any Node.js project
-
-set -e
-
-# Colors
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-BLUE='\033[0;34m'
-NC='\033[0m' # No Color
-
-# Configuration
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-TARGET_DIR="${1:-.}"
-UPDATE_MODE=false
-
-# Parse arguments
-for arg in "$@"; do
-    case $arg in
-        --update)
-            UPDATE_MODE=true
-            shift
-            ;;
-        --help)
-            echo "Usage: $0 [target-directory] [--update]"
-            echo ""
-            echo "Options:"
-            echo "  target-directory  Directory where to install (default: current directory)"
-            echo "  --update          Update existing installation (preserves config)"
-            echo "  --help            Show this help message"
-            exit 0
-            ;;
-    esac
-done
-
-echo -e "${BLUE}========================================"
-echo "NPM Security Kit - Installation"
-echo -e "========================================${NC}"
-echo ""
-
-# Check if target directory exists
-if [ ! -d "$TARGET_DIR" ]; then
-    echo -e "${RED}✗ Target directory does not exist: $TARGET_DIR${NC}"
-    exit 1
-fi
-
-# Check if it's a Node.js project
-if [ ! -f "$TARGET_DIR/package.json" ]; then
-    echo -e "${YELLOW}⚠ Warning: package.json not found in $TARGET_DIR${NC}"
-    echo -e "${YELLOW}  This might not be a Node.js project.${NC}"
-    read -p "Continue anyway? (y/n) " -n 1 -r
-    echo
-    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
-        exit 1
-    fi
-fi
-
-cd "$TARGET_DIR"
-
-echo -e "${GREEN}✓ Target directory: $(pwd)${NC}"
-echo ""
-
-# Check for required tools
-echo "Checking required tools..."
-MISSING_TOOLS=()
-
-if ! command -v jq &> /dev/null; then
-    MISSING_TOOLS+=("jq")
-fi
-
-if ! command -v npm &> /dev/null; then
-    MISSING_TOOLS+=("npm")
-fi
-
-if [ ${#MISSING_TOOLS[@]} -gt 0 ]; then
-    echo -e "${RED}✗ Missing required tools: ${MISSING_TOOLS[*]}${NC}"
-    echo ""
-    echo "Install them with:"
-    for tool in "${MISSING_TOOLS[@]}"; do
-        case $tool in
-            jq)
-                echo "  - Ubuntu/Debian: sudo apt-get install jq"
-                echo "  - macOS: brew install jq"
-                ;;
-            npm)
-                echo "  - Visit: https://nodejs.org/"
-                ;;
-        esac
-    done
-    exit 1
-fi
-
-echo -e "${GREEN}✓ All required tools available${NC}"
-echo ""
-
-# Create directories
-echo "Creating directory structure..."
-mkdir -p .security
-mkdir -p scripts
-mkdir -p .github/workflows
-
-echo -e "${GREEN}✓ Directories created${NC}"
-echo ""
-
-# Copy security files
-echo "Installing security files..."
-
-# Template directory
-TEMPLATE_DIR="$SCRIPT_DIR/../template"
-
-# 1. Blacklist
-if [ -f "$TEMPLATE_DIR/.security/malicious-packages-blacklist.json" ]; then
-    cp "$TEMPLATE_DIR/.security/malicious-packages-blacklist.json" .security/
-    echo -e "${GREEN}  ✓ Blacklist installed${NC}"
-else
-    echo -e "${RED}  ✗ Error: Blacklist template not found${NC}"
-    echo -e "${YELLOW}  Expected: $TEMPLATE_DIR/.security/malicious-packages-blacklist.json${NC}"
-    exit 1
-fi
-
-# 2. Config
-if [ "$UPDATE_MODE" = false ] || [ ! -f ".security/config.json" ]; then
-    cat > .security/config.json <<'EOF'
-{
-  "projectName": "my-project",
-  "projectType": "node",
-  "excludeDirs": ["node_modules", "dist", "build", ".next"],
-  "strictMode": true,
-  "notifications": {
-    "enabled": false,
-    "email": "",
-    "slack": ""
-  },
-  "autofix": {
-    "enabled": false,
-    "level": "moderate"
-  }
-}
-EOF
-    echo -e "${GREEN}  ✓ Config created${NC}"
-else
-    echo -e "${BLUE}  → Config preserved (update mode)${NC}"
-fi
-
-# 3. Scripts
-if [ -f "$TEMPLATE_DIR/scripts/check-malicious-packages.sh" ]; then
-    cp "$TEMPLATE_DIR/scripts/check-malicious-packages.sh" scripts/
-    chmod +x scripts/check-malicious-packages.sh
-else
-    echo -e "${RED}  ✗ Error: check-malicious-packages.sh not found${NC}"
-    exit 1
-fi
-
-if [ -f "$TEMPLATE_DIR/scripts/security-check.sh" ]; then
-    cp "$TEMPLATE_DIR/scripts/security-check.sh" scripts/
-    chmod +x scripts/security-check.sh
-else
-    echo -e "${RED}  ✗ Error: security-check.sh not found${NC}"
-    exit 1
-fi
-
-echo -e "${GREEN}  ✓ Scripts installed${NC}"
-
-# 4. GitHub Actions
-if [ -f "$TEMPLATE_DIR/.github/workflows/security-audit.yml" ]; then
-    cp "$TEMPLATE_DIR/.github/workflows/security-audit.yml" .github/workflows/
-else
-    echo -e "${RED}  ✗ Error: security-audit.yml not found${NC}"
-    exit 1
-fi
-
-echo -e "${GREEN}  ✓ GitHub Actions workflow installed${NC}"
-
-# 5. Dependabot
-if [ -f "$TEMPLATE_DIR/.github/dependabot.yml" ]; then
-    cp "$TEMPLATE_DIR/.github/dependabot.yml" .github/
-else
-    echo -e "${RED}  ✗ Error: dependabot.yml not found${NC}"
-    exit 1
-fi
-
-echo -e "${GREEN}  ✓ Dependabot config installed${NC}"
-
-# 6. SECURITY.md
-if [ "$UPDATE_MODE" = false ] || [ ! -f "SECURITY.md" ]; then
-    cat > SECURITY.md <<'EOF'
-# Security Documentation
-
-## Quick Reference
-
-### Security Commands
-
-```bash
-# Check for malicious packages
-npm run security:check-malicious
-
-# Full security audit
-npm run security:full
-
-# npm audit only
-npm run security:audit
-
-# Auto-fix vulnerabilities
-npm run security:audit:fix
-
-# Check outdated packages
-npm run security:outdated
-
-# Verify licenses
-npm run security:licenses
-```
-
-## Current Security Status
-
-**Last Audit**: Run `npm run security:full` to check
-
-## Automated Protection
-
-- ✅ Blacklist of 175+ known malicious packages
-- ✅ GitHub Actions (weekly scans)
-- ✅ Dependabot (automatic updates)
-- ✅ Pre-deployment checks
-
-## Reporting Security Issues
-
-If you discover a security vulnerability, please report it to the security team.
-
-## Resources
-
-- NPM Security Kit: https://github.com/tu-org/npm-security-kit
-- Socket.dev: https://socket.dev
-- npm Security: https://docs.npmjs.com/security
-EOF
-    echo -e "${GREEN}  ✓ SECURITY.md created${NC}"
-else
-    echo -e "${BLUE}  → SECURITY.md preserved (update mode)${NC}"
-fi
-
-echo ""
-
-# Add npm scripts
-echo "Adding npm scripts to package.json..."
-
-if [ -f "package.json" ]; then
-    # Check if scripts already exist
-    if grep -q '"security:check-malicious"' package.json; then
-        echo -e "${BLUE}  → Scripts already exist, skipping${NC}"
-    else
-        # Backup package.json
-        cp package.json package.json.backup
-
-        # Add scripts using jq
-        jq '.scripts += {
-            "security:check": "./scripts/security-check.sh",
-            "security:check-malicious": "./scripts/check-malicious-packages.sh",
-            "security:audit": "npm audit --audit-level=moderate",
-            "security:audit:fix": "npm audit fix",
-            "security:outdated": "npm outdated",
-            "security:licenses": "npm list --json | jq -r '\''.dependencies | to_entries[] | \"\\(.key): \\(.value.license)\"'\''",
-            "security:full": "npm run security:audit && npm run security:check"
-        }' package.json > package.json.tmp
-
-        mv package.json.tmp package.json
-        echo -e "${GREEN}  ✓ Scripts added to package.json${NC}"
-        echo -e "${BLUE}  → Backup saved as package.json.backup${NC}"
-    fi
-else
-    echo -e "${YELLOW}  ⚠ package.json not found, skipping script installation${NC}"
-fi
-
-echo ""
-
-# Run initial check
-echo "Running initial security check..."
-if npm run security:check-malicious > /dev/null 2>&1; then
-    echo -e "${GREEN}✓ Initial check passed - No malicious packages detected${NC}"
-else
-    echo -e "${YELLOW}⚠ Check completed with warnings${NC}"
-fi
-
-echo ""
-echo -e "${BLUE}========================================"
-echo "Installation Complete!"
-echo -e "========================================${NC}"
-echo ""
-echo "Files installed:"
-echo "  ✓ .security/malicious-packages-blacklist.json"
-echo "  ✓ .security/config.json"
-echo "  ✓ scripts/check-malicious-packages.sh"
-echo "  ✓ scripts/security-check.sh"
-echo "  ✓ .github/workflows/security-audit.yml"
-echo "  ✓ .github/dependabot.yml"
-echo "  ✓ SECURITY.md"
-echo "  ✓ package.json (scripts added)"
-echo ""
-echo "Next steps:"
-echo ""
-echo "  1. Verify installation:"
-echo "     npm run security:check-malicious"
-echo ""
-echo "  2. Run full audit:"
-echo "     npm run security:full"
-echo ""
-echo "  3. Customize config:"
-echo "     Edit .security/config.json"
-echo ""
-echo "  4. Commit files:"
-echo "     git add .security scripts .github SECURITY.md package.json"
-echo "     git commit -m \"security: add npm security kit\""
-echo ""
-echo "  5. Push to enable GitHub Actions:"
-echo "     git push"
-echo ""
-echo -e "${GREEN}Your project is now protected!${NC} 🛡️"
-echo ""