@theoptimalpartner/npm-security-kit 1.0.2 → 2.0.0-beta.1

package/CHANGELOG.md

@@ -1,127 +1,46 @@
 # Changelog
 
-All notable changes to this project will be documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
-## [Unreleased]
-
-## [1.0.1] - 2025-10-21
-
-### Fixed
-- Corrected template directory paths in `install.sh` to work properly when installed in `node_modules`
-- Changed hardcoded paths from `SCRIPT_DIR/template/` to `SCRIPT_DIR/../template/`
-- Removed fallback references to `auth-service` directory
-- Added proper error messages when template files are not found
-
-### Changed
-- Installation script now properly resolves paths when package is installed as dependency
-
-## [1.0.0] - 2025-10-21
-
-### Added
-- Initial release of NPM Security Kit
-- Blacklist of 175+ known malicious npm packages from Socket.dev October 2025 phishing campaign
-- Pattern matching for malicious package detection (`redirect-*` pattern)
-- Malicious domains and suspicious npm accounts tracking
-- Automated installation script (`install.sh`) for easy project setup
-- CLI tools:
-  - `npm-security-install` - Install security infrastructure in projects
-  - `npm-security-check` - Quick malicious package check
-- Programmatic API for advanced integration:
-  - `loadBlacklist()` - Load malicious packages database
-  - `isMalicious(packageName)` - Check if package is in blacklist
-  - `matchesMaliciousPattern(packageName)` - Check against malicious patterns
-- Security scripts:
-  - `check-malicious-packages.sh` - Verify packages against blacklist
-  - `security-check.sh` - Comprehensive security audit (10 checks)
-- GitHub Actions workflow with 6 security jobs:
-  - npm audit
-  - Socket.dev integration
-  - Dependency review
-  - License verification
-  - Malicious pattern detection
-  - Known malicious packages check
-- Dependabot configuration for automated dependency updates
-- Project configuration file (`.security/config.json`)
-- Comprehensive documentation:
-  - README.md - Full package documentation
-  - QUICK_START.md - 3-minute installation guide
-  - EXAMPLES.md - 12 real-world usage scenarios
-  - PUBLISHING.md - Guide for package publication
-- Automatic npm scripts injection into `package.json`:
-  - `security:check-malicious`
-  - `security:check`
-  - `security:audit`
-  - `security:audit:fix`
-  - `security:outdated`
-  - `security:licenses`
-  - `security:full`
-- SECURITY.md template for projects
-- Support for both new and existing projects
-- Update mode (`--update` flag) to preserve existing configurations
-
-### Security
-- Protection against 175+ known malicious packages
-- Automated weekly security scans via GitHub Actions
-- Pre-deployment security checks
-- Vulnerability detection and auto-fix capabilities
-
-## [0.0.0] - 2025-10-20
-
-### Development
-- Project structure created
-- Template files developed
-- Initial testing in auth-service, jwt-auth-package, and auth-react-client projects
-
----
-
-## Version History Summary
-
-- **1.0.1** - Bug fix for installation paths
-- **1.0.0** - Initial public release
-- **0.0.0** - Development phase
-
-## Upgrade Guide
-
-### From 1.0.0 to 1.0.1
-
-No breaking changes. Simply update the package:
-
-```bash
-npm update @theoptimalpartner/npm-security-kit
-```
-
-If you want to refresh your security files:
-
-```bash
-bash ./node_modules/@theoptimalpartner/npm-security-kit/bin/install.sh --update
-```
-
-## Links
-
-- [npm Package](https://www.npmjs.com/package/@theoptimalpartner/npm-security-kit)
-- [Bitbucket Repository](https://bitbucket.org/RoutingUC/npm-security-kit)
-- [Socket.dev - Original Research](https://socket.dev)
-
-## Contributing
-
-When making changes that affect the public API or user experience:
-
-1. Update this CHANGELOG.md following Keep a Changelog format
-2. Categorize changes as:
-   - **Added** - New features
-   - **Changed** - Changes in existing functionality
-   - **Deprecated** - Soon-to-be removed features
-   - **Removed** - Removed features
-   - **Fixed** - Bug fixes
-   - **Security** - Security improvements
-3. Use semantic versioning:
-   - MAJOR - Breaking changes
-   - MINOR - New features (backwards compatible)
-   - PATCH - Bug fixes (backwards compatible)
-
-## Reporting Issues
-
-If you discover a security vulnerability or malicious package not in our blacklist, please report it immediately at the Bitbucket repository issues page.
+Cambios del paquete `@theoptimalpartner/npm-security-kit`. Formato basado en
+[Keep a Changelog](https://keepachangelog.com/es-ES/1.1.0/); versiones con [SemVer](https://semver.org/lang/es/).
+
+## [2.0.0] - sin publicar
+
+Reescritura completa. La v2 es una CLI de Node sin dependencias que corre en el pipeline **antes de `npm ci`**.
+Sale primero como beta (`2.0.0-beta.N`), con el dist-tag `beta`. Desde la `2.0.0-beta.1`, el step del pipeline y
+`init` usan `npx --yes --min-release-age=0`: `npx` no aplica `min-release-age-exclude` y, sin el flag, una versión
+nueva del kit no se puede usar hasta cumplir 7 días.
+
+### BREAKING
+
+- Un solo comando, `npm-security-kit`, con los subcomandos `check` e `init`. Se quitan los `bin`
+  `npm-security-install`, `npm-security-check`, `npm-security-setup-husky` y `npm-security-integrate-pipeline`.
+- Se quita la blacklist de 175 paquetes, `src/index.js` (`isMalicious`, `matchesMaliciousPattern`) y
+  `.security/config.json`: los advisories del registro de npm ya cubren esos paquetes, y la lista solo miraba las
+  dependencias directas, después de instalar.
+- Se quitan `check-malicious-packages.sh` y `security-check.sh` (se cortaba en el paso 2), husky y sus hooks, la
+  plantilla de `bitbucket-pipelines.yml` (pisaba el pipeline del proyecto) y el `SECURITY.md` generado.
+- Se quitan AUTOMATION_GUIDE, QUICK_START, EXAMPLES, NPM_SECURITY_KIT_SUMMARY y NPM_SECURITY_PROTOCOL. Quedan
+  el README (uso) y este CHANGELOG.
+- Requiere Node ≥ 18.3.
+
+### Agregado
+
+- `check`: malware (CWE-506) en todo el árbol y con cualquier severidad; vulnerabilidades `critical` en producción;
+  versión de Node contra el calendario de nodejs.org; claves del `.npmrc`, `engines.npm`, npm en uso y lockfile;
+  install scripts contra `allowScripts`; Dockerfiles que instalan sin el `.npmrc`. Salida en texto o `--json`,
+  exit 0/1/2.
+- `init`: completa `.npmrc` y `engines` sin borrar nada, lista los install scripts por aprobar y muestra el step
+  del pipeline y los cambios de los Dockerfiles. `--dry-run` muestra el diff.
+- Override de install scripts por repo con `npm_config_strict_allow_scripts=false`.
+
+### Cómo migrar desde la 1.x
+
+1. Borrar lo que instaló la v1, si no se usa para otra cosa: `.security/`, `scripts/check-malicious-packages.sh`,
+   `scripts/security-check.sh`, `.husky/` (y el `"prepare": "husky install"`), los scripts `security:*` del
+   `package.json` y el `SECURITY.md` generado.
+2. Si la v1 reemplazó el `bitbucket-pipelines.yml`, recuperar el del repo desde git.
+3. Correr `npx --yes --min-release-age=0 @theoptimalpartner/npm-security-kit@2.0.0 init` y seguir los pasos que imprime (README).
+
+## [1.0.2] y anteriores
+
+Versiones 1.x, sin mantenimiento desde la 2.0.0. Para migrar, ver arriba.

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2025 Your Organization
+Copyright (c) 2025 The Optimal Partner
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal