@webimpian/node-log-central 1.0.2 → 1.1.0

package/README.md

@@ -64,6 +64,22 @@ process.on('SIGTERM', () => logs.close());
 
 Delivery semantics: batches that fail with a network error or 5xx stay queued and retry with capped backoff (max 60s); batches rejected with a 4xx are dropped (retrying cannot fix them) and reported to `onError`.
 
+## Vulnerable packages
+
+Call `reportPackages()` once at startup. It sends the name and version of every package in `package-lock.json` to Log Central now, and again once a day. Log Central checks them against known vulnerabilities and alerts on critical, high or actively exploited ones. Only names and versions leave the app.
+
+```
+logs.reportPackages();
+```
+
+| Option | Default | Purpose |
+|---|---|---|
+| `dir` | `process.cwd()` | Folder that holds `package-lock.json` |
+| `name` | the app's slug | Name shown in Log Central, for an app with more than one lockfile |
+| `interval` | 24 hours | Time between reports, in ms |
+
+It returns a promise for `true` when Log Central accepted the list and never throws; failures go to `onError`. `logs.close()` stops the daily repeat. Needs Log Central v1.16.4 or newer.
+
 ## Testing
 
 ```

package/lib/client.js

@@ -2,6 +2,7 @@
 
 const os = require('node:os');
 const crypto = require('node:crypto');
+const { collectPackages } = require('./packages');
 
 const LEVELS = ['debug', 'info', 'notice', 'warning', 'error', 'critical', 'alert', 'emergency'];
 
@@ -17,6 +18,8 @@ const ENTRYPOINTS = ['http', 'console', 'queue'];
 
 const MAX_BATCH = 1000;
 
+const DAY = 24 * 60 * 60 * 1000;
+
 function formatTimestamp(date = new Date()) {
     const pad = (value, width = 2) => String(value).padStart(width, '0');
 
@@ -95,6 +98,7 @@ class LogCentralClient {
         this.failures = 0;
         this.retryAt = 0;
         this.flushing = null;
+        this.packagesTimer = null;
 
         this.timer = setInterval(() => {
             this.flush().catch(() => {});
@@ -205,8 +209,61 @@ class LogCentralClient {
         return this.flushing;
     }
 
+    // Sends the installed npm package versions for vulnerability checks, now and then once a day.
+    reportPackages(options = {}) {
+        const send = () => this.#sendPackages(options).catch(() => false);
+
+        clearInterval(this.packagesTimer);
+        this.packagesTimer = setInterval(send, options.interval || DAY);
+
+        if (typeof this.packagesTimer.unref === 'function') {
+            this.packagesTimer.unref();
+        }
+
+        return send();
+    }
+
+    async #sendPackages(options) {
+        const inventory = {
+            kind: 'node',
+            hostname: this.hostname,
+            runtime: { node: process.versions.node },
+            packages: collectPackages(options.dir),
+        };
+
+        if (options.name) {
+            inventory.name = options.name;
+        }
+
+        try {
+            const response = await this.fetch(`${this.url}/packages`, {
+                method: 'POST',
+                headers: {
+                    authorization: `Bearer ${this.token}`,
+                    'content-type': 'application/json',
+                },
+                body: JSON.stringify(inventory),
+                signal: AbortSignal.timeout(this.requestTimeout),
+            });
+
+            if (response.status >= 400) {
+                const body = await response.text().catch(() => '');
+                this.#report(new Error(`Log Central rejected the package list (${response.status}): ${body.slice(0, 200)}`));
+
+                return false;
+            }
+
+            return true;
+        } catch (err) {
+            this.#report(err);
+
+            return false;
+        }
+    }
+
     async close() {
         clearInterval(this.timer);
+        clearInterval(this.packagesTimer);
         this.retryAt = 0;
         await this.flush();
     }

package/lib/index.js

@@ -1,5 +1,6 @@
 'use strict';
 
 const { LogCentralClient, formatTimestamp, safeStringify, LEVELS } = require('./client');
+const { collectPackages } = require('./packages');
 
-module.exports = { LogCentralClient, formatTimestamp, safeStringify, LEVELS };
+module.exports = { LogCentralClient, formatTimestamp, safeStringify, LEVELS, collectPackages };

package/lib/packages.js

@@ -0,0 +1,61 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const MAX_PACKAGES = 10000;
+
+function fromLockfileV1(dependencies, found) {
+    for (const [name, entry] of Object.entries(dependencies || {})) {
+        if (!entry || typeof entry.version !== 'string') {
+            continue;
+        }
+
+        found.push({ ecosystem: 'npm', name, version: entry.version, dev: entry.dev === true });
+        fromLockfileV1(entry.dependencies, found);
+    }
+}
+
+function collectPackages(dir = process.cwd()) {
+    let lock;
+
+    try {
+        lock = JSON.parse(fs.readFileSync(path.join(dir, 'package-lock.json'), 'utf8'));
+    } catch {
+        return [];
+    }
+
+    const found = [];
+
+    if (lock && typeof lock.packages === 'object' && lock.packages !== null) {
+        for (const [location, entry] of Object.entries(lock.packages)) {
+            if (location === '' || !entry || typeof entry.version !== 'string' || entry.link === true) {
+                continue;
+            }
+
+            const at = location.lastIndexOf('node_modules/');
+
+            found.push({
+                ecosystem: 'npm',
+                name: entry.name || (at === -1 ? location : location.slice(at + 13)),
+                version: entry.version,
+                dev: entry.dev === true,
+            });
+        }
+    } else {
+        // Lockfile v1 has no "packages" map, only nested "dependencies".
+        fromLockfileV1(lock && lock.dependencies, found);
+    }
+
+    const seen = new Set();
+
+    return found
+        .filter(entry => {
+            const key = `${entry.name}@${entry.version}|${entry.dev}`;
+
+            return seen.has(key) ? false : seen.add(key);
+        })
+        .slice(0, MAX_PACKAGES);
+}
+
+module.exports = { collectPackages };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@webimpian/node-log-central",
-    "version": "1.0.2",
+    "version": "1.1.0",
     "description": "Ship logs and errors from Node.js applications to a Log Central server.",
     "keywords": [
         "logging",