@vltpkg/security-archive 1.0.3 → 1.0.5

package/dist/index.d.ts

@@ -1,8 +1,9 @@
 import { LRUCache } from 'lru-cache';
 import type { DepID } from '@vltpkg/dep-id';
+import type { NodeLike } from '@vltpkg/types';
 import type { PackageReportData, SecurityArchiveLike, SecurityArchiveRefreshOptions } from './types.ts';
 export * from './types.ts';
-export declare const targetSecurityRegisty = "https://registry.npmjs.org/";
+export declare const npmRegistryURL = "https://registry.npmjs.org/";
 export type JSONItemResponse = {
     namespace?: `@{string}`;
     name: string;
@@ -38,6 +39,12 @@ export type SecurityArchiveOptions = LRUCache.OptionsBase<DepID, PackageReportDa
      */
     retries?: number;
 };
+/**
+ * Socket.dev only has reports for the public npm ecosystem. Eligible
+ * when the node's origin is `https://registry.npmjs.org/` or the URL
+ * configured as `registries.npm`.
+ */
+export declare const usesNpmRegistry: (node: NodeLike) => boolean;
 export declare const version: string;
 /**
  * A database of security information for given packages from a list of nodes.

package/dist/index.js

@@ -8,27 +8,35 @@ import pRetry, { AbortError } from 'p-retry';
 import { loadPackageJson } from 'package-json-from-dist';
 import { asDepID, splitDepID, baseDepID } from '@vltpkg/dep-id';
 import { error } from '@vltpkg/error-cause';
+import { defaultRegistryName } from '@vltpkg/spec';
 import { XDG } from '@vltpkg/xdg';
 import { asPackageReportData } from "./types.js";
 import { __CODE_SPLIT_SCRIPT_NAME } from "./update-expired.js";
 export * from "./types.js";
 const SOCKET_API_V0_URL = 'https://api.socket.dev/v0/purl?alerts=true';
 const SOCKET_PUBLIC_API_TOKEN = 'sktsec_t_--RAN5U4ivauy4w37-6aoKyYPDt5ZbaT5JBVMqiwKo_api';
-export const targetSecurityRegisty = 'https://registry.npmjs.org/';
+export const npmRegistryURL = 'https://registry.npmjs.org/';
+const normalizeRegistryURL = (url) => url.endsWith('/') ? url : `${url}/`;
+const nodeRegistryURL = (node) => {
+    const [type, reg] = splitDepID(node.id);
+    if (type !== 'registry')
+        return;
+    const url = /^https?:\/\//.test(reg) ? reg : node.options.registries?.[reg];
+    return url ? normalizeRegistryURL(url) : undefined;
+};
 /**
- * Only the public npm registry has information available in the
- * socket.dev API. This function checks if a given depID is pointing
- * to the public npm registry and returns `true` if it does.
+ * Socket.dev only has reports for the public npm ecosystem. Eligible
+ * when the node's origin is `https://registry.npmjs.org/` or the URL
+ * configured as `registries.npm`.
  */
-const usesTargetRegistry = (node) => {
-    const depID = node.id;
-    const specOptions = node.options;
-    const [nodeType, nodeRegistry] = splitDepID(depID);
-    if (nodeType !== 'registry') {
+export const usesNpmRegistry = (node) => {
+    const origin = nodeRegistryURL(node);
+    if (!origin)
         return false;
-    }
-    const reg = specOptions.registries?.[nodeRegistry];
-    return reg === targetSecurityRegisty;
+    if (origin === npmRegistryURL)
+        return true;
+    const npmAlias = node.options.registries?.[defaultRegistryName];
+    return !!npmAlias && normalizeRegistryURL(npmAlias) === origin;
 };
 // Loads the version number to be used in the User-Agent header
 export const { version } = loadPackageJson(import.meta.filename, process.env.__VLT_INTERNAL_CLI_PACKAGE_JSON);
@@ -211,10 +219,9 @@ export class SecurityArchive extends LRUCache {
         const queue = new Set();
         for (const node of this.#nodesByID.values()) {
             const normalizedId = baseDepID(node.id);
-            // only queue up valid public registry
-            // references that are missing from the archive
+            // only queue npm-ecosystem registry refs missing from the archive
             // also skips any pkg marked as expired
-            if (usesTargetRegistry(node) &&
+            if (usesNpmRegistry(node) &&
                 !this.has(normalizedId) &&
                 !this.#expired.has(normalizedId)) {
                 const purl = `pkg:npm/${node.name}@${node.version}`;
@@ -318,12 +325,12 @@ export class SecurityArchive extends LRUCache {
         }
     }
     /**
-     * Validates that all public-registry packages in the nodes
+     * Validates that all npm-ecosystem packages in the nodes
      * have a valid report data in the current in-memory cache.
      */
     #validateReportData() {
         for (const node of this.#nodesByID.values()) {
-            if (usesTargetRegistry(node)) {
+            if (usesNpmRegistry(node)) {
                 if (!this.has(baseDepID(node.id))) {
                     this.ok = false;
                     return;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/security-archive",
   "description": "A database of security information of packages",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",
@@ -13,11 +13,11 @@
     "url": "http://vlt.sh"
   },
   "dependencies": {
-    "@vltpkg/dep-id": "1.0.3",
-    "@vltpkg/error-cause": "1.0.3",
-    "@vltpkg/spec": "1.0.3",
-    "@vltpkg/types": "1.0.3",
-    "@vltpkg/xdg": "1.0.3",
+    "@vltpkg/dep-id": "1.0.5",
+    "@vltpkg/error-cause": "1.0.5",
+    "@vltpkg/spec": "1.0.5",
+    "@vltpkg/types": "1.0.5",
+    "@vltpkg/xdg": "1.0.5",
     "lru-cache": "^11.2.4",
     "p-retry": "^7.1.1",
     "package-json-from-dist": "^1.0.1"