forged-cli 0.2.0 → 0.3.0

package/bin/forged.js

@@ -44,9 +44,13 @@ if (command === 'readme') {
 
 if (command === 'scan') {
   const { scanCommand } = await import('../src/commands/scan.js');
+  const { resolve } = await import('path');
   const report       = args.includes('--report') || args.includes('--report-md');
   const reportFormat = args.includes('--report-md') ? 'markdown' : 'json';
-  await scanCommand(process.cwd(), { report, reportFormat });
+  const verbose      = args.includes('--verbose') || args.includes('-v');
+  const pathArg      = args.find(a => !a.startsWith('--'));
+  const targetPath   = pathArg ? resolve(pathArg) : process.cwd();
+  await scanCommand(targetPath, { report, reportFormat, verbose });
   process.exit(0);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forged-cli",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "A complete dev environment toolkit — shell, workflows, and project scaffolding in one install.",
   "keywords": [
     "cli",

package/src/commands/scan.js

@@ -107,12 +107,12 @@ function saveMarkdownReport(reportPath, data) {
 }
 
 export async function scanCommand(cwd = process.cwd(), opts = {}) {
-  const { report, reportFormat = 'json' } = opts;
+  const { report, reportFormat = 'json', verbose = false } = opts;
 
   console.log(`\n${bold}⚒  Forged Scanner${reset}`);
   console.log(`   Scanning: ${cwd}\n`);
 
-  const findings = { warnings: [], errors: [], info: [] };
+  const findings = { warnings: [], errors: [], info: [], suppressed: [] };
   let packagesVerified = 0;
 
   // 1. Parse package.json
@@ -127,7 +127,9 @@ export async function scanCommand(cwd = process.cwd(), opts = {}) {
   }
 
   // 3. Typosquat check
+  const popularSet = new Set(POPULAR_PACKAGES);
   for (const name of Object.keys(deps)) {
+    if (popularSet.has(name)) continue;
     for (const { known, distance } of isSuspiciousName(name, POPULAR_PACKAGES)) {
       findings.warnings.push({
         package: name,
@@ -153,7 +155,9 @@ export async function scanCommand(cwd = process.cwd(), opts = {}) {
   } else {
     packagesVerified = total || 0;
     for (const f of integrityFindings) {
-      (f.type === 'error' ? findings.errors : findings.warnings).push(f);
+      if (f.type === 'error')        findings.errors.push(f);
+      else if (f.type === 'info')    findings.suppressed.push(f);
+      else                           findings.warnings.push(f);
     }
     if (total) findings.info.push(`Verified ${total} packages against npm registry`);
   }
@@ -192,12 +196,25 @@ export async function scanCommand(cwd = process.cwd(), opts = {}) {
     }
   }
 
+  // Verbose: show suppressed trusted rotations
+  if (verbose && findings.suppressed.length > 0) {
+    console.log(`${bold}SUPPRESSED — trusted publisher rotations:${reset}`);
+    for (const s of findings.suppressed) {
+      console.log(`  ${green}~${reset}  ${s.package}@${s.version}: ${s.message}`);
+    }
+    console.log();
+  }
+
   if (findings.info.length > 0) {
     for (const i of findings.info) console.log(`  ${green}ℹ${reset}  ${i}`);
-    console.log();
   }
+  if (findings.suppressed.length > 0) {
+    const note = verbose ? '' : '  (run with --verbose to see them)';
+    console.log(`  ${green}ℹ${reset}  ${findings.suppressed.length} trusted publisher rotation(s) suppressed${note}`);
+  }
+  console.log();
 
-  console.log(`${bold}Summary:${reset} ${findings.errors.length} error(s), ${findings.warnings.length} warning(s)\n`);
+  console.log(`${bold}Summary:${reset} ${findings.errors.length} error(s), ${findings.warnings.length} warning(s), ${findings.suppressed.length} suppressed\n`);
 
   // Save report if requested
   if (report) {

package/src/utils/trustedPublishers.js

@@ -0,0 +1,27 @@
+// Known npm core team — ownership rotates freely between these accounts
+export const NPM_TEAM = new Set([
+  'isaacs', 'gar', 'lukekarrys', 'nlf', 'zkat', 'ruyadorno',
+  'npm-cli-ops', 'iarna', 'darcyclarke', 'wraithgar', 'fritzy',
+  'GitHub Actions',
+]);
+
+// Trusted community maintainers — well-known, long-standing accounts
+export const TRUSTED_COMMUNITY = new Set([
+  'sindresorhus', 'jbnicolai', 'jonschlinkert', 'doowb',
+  'tjholowaychuk', 'dominicbarnes', 'loganfsmyth', 'eemeli',
+  'styfle', 'leo', 'dsblv', 'ljharb', 'nicolo-ribaudo',
+  'mysticatea', 'feross', 'mafintosh',
+  'phated', 'nodejs-foundation', 'legendecas',
+  'ulisesgascon', 'formidablelabs',
+  'blakeembrey', 'wesleytodd', 'danez', 'domenic', 'panva', 'joshuakgoldberg',
+  'matteo.collina', 'rvagg',
+]);
+
+export function classifyPublisherChange(from, to) {
+  const fromTrusted = NPM_TEAM.has(from) || TRUSTED_COMMUNITY.has(from);
+  const toTrusted   = NPM_TEAM.has(to)   || TRUSTED_COMMUNITY.has(to);
+
+  if (toTrusted)   return 'info';   // handed to a trusted publisher — suppress
+  if (fromTrusted) return 'warn';   // trusted → unknown — flag it
+  return 'warn';                    // unknown → unknown — flag it
+}

package/src/utils/verifyIntegrity.js

@@ -1,5 +1,6 @@
 import { readFileSync, existsSync } from 'fs';
 import { join } from 'path';
+import { classifyPublisherChange } from './trustedPublishers.js';
 
 // Fetch registry metadata with a simple in-memory cache to avoid duplicate requests
 const registryCache = new Map();
@@ -108,12 +109,13 @@ export async function verifyTarballIntegrity(cwd, onProgress) {
       const versions = Object.keys(registryMeta.versions || {});
       const idx = versions.indexOf(meta.version);
       if (idx > 0) {
-        const prevVersion = versions[idx - 1];
-        const prevPublisher = registryMeta.versions[prevVersion]?._npmUser?.name;
-        const currPublisher = versionData._npmUser?.name;
+        const prevVersion    = versions[idx - 1];
+        const prevPublisher  = registryMeta.versions[prevVersion]?._npmUser?.name;
+        const currPublisher  = versionData._npmUser?.name;
         if (prevPublisher && currPublisher && prevPublisher !== currPublisher) {
+          const severity = classifyPublisherChange(prevPublisher, currPublisher);
           findings.push({
-            type: 'warning',
+            type: severity,
             package: name,
             version: meta.version,
             message: `Publisher changed from "${prevPublisher}" to "${currPublisher}" in this version`,