forged-cli 0.3.4 → 0.3.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forged-cli",
-  "version": "0.3.4",
+  "version": "0.3.7",
   "description": "A complete dev environment toolkit — shell, workflows, and project scaffolding in one install.",
   "keywords": [
     "cli",
@@ -12,10 +12,11 @@
   ],
   "author": "Brandon <DevBrandon@icloud.com> (https://github.com/bkness)",
   "license": "MIT",
-  "homepage": "https://github.com/bkness/forged-cli#readme",
+  "homepage": "https://www.weballtech.com",
   "repository": {
     "type": "git",
-    "url": "git+ssh://git@github.com/bkness/forged-cli.git"
+    "url": "git+ssh://git@github.com/bkness/forged-cli.git",
+    "directory": "https//www.weballtech.com/manual.html"
   },
   "bugs": {
     "url": "https://github.com/bkness/forged-cli/issues"

package/src/commands/scan.js

@@ -1,6 +1,7 @@
 import { readFileSync, existsSync, readdirSync, statSync, writeFileSync } from 'fs';
 import { createHash } from 'crypto';
 import { join, basename } from 'path';
+import { homedir } from 'os';
 import { isSuspiciousName } from '../utils/levenshtein.js';
 import { POPULAR_PACKAGES } from '../utils/popularPackages.js';
 import { verifyTarballIntegrity } from '../utils/verifyIntegrity.js';
@@ -131,8 +132,14 @@ export async function scanCommand(cwd = process.cwd(), opts = {}) {
   for (const name of Object.keys(deps)) {
     if (popularSet.has(name)) continue;
     for (const { known, distance } of isSuspiciousName(name, POPULAR_PACKAGES)) {
+      let resolvedVersion;
+      try {
+        const nmPkg = JSON.parse(readFileSync(join(cwd, 'node_modules', name, 'package.json'), 'utf8'));
+        resolvedVersion = nmPkg.version;
+      } catch {}
       findings.warnings.push({
         package: name,
+        version: resolvedVersion,
         message: `${distance} character(s) from popular package "${known}" — possible typosquat`,
       });
     }
@@ -216,6 +223,22 @@ export async function scanCommand(cwd = process.cwd(), opts = {}) {
 
   console.log(`${bold}Summary:${reset} ${findings.errors.length} error(s), ${findings.warnings.length} warning(s), ${findings.suppressed.length} suppressed\n`);
 
+  // Write local scan cache — dotfiles reads this to push telemetry
+  const flagged = [
+    ...findings.errors.filter(f => f.package).map(f => f.package),
+    ...findings.warnings.filter(f => f.package).map(f => f.package),
+  ];
+  writeFileSync(
+    join(homedir(), '.forged-scan-cache.json'),
+    JSON.stringify({
+      safe:       findings.errors.length === 0 && findings.warnings.length === 0,
+      packages:   packagesVerified,
+      flagged,
+      checked_at: new Date().toISOString(),
+    }),
+    'utf8'
+  );
+
   // Save report if requested
   if (report) {
     const reportData = {

package/src/utils/trustedPublishers.js

@@ -36,13 +36,27 @@ export const TRUSTED_COMMUNITY = new Set([
   // perfect-scrollbar current maintainer
   'mattonit',
   // Mapbox internal npm account rotation
-  'mapbox-npm-01', 'mapbox-npm-03',
+  'mapbox-npm-01', 'mapbox-npm-03', 'mbx-npm-02-production', 'mbx-npm-03-production',
   // Prettier automated release bot (replaced fisker)
   'prettier-bot',
   // Sequelize current maintainer (replaced sdepold, original creator)
   'wikirik',
   // Meta/React Native core team (replaced zertosh on v8-compile-cache)
   'yungsters',
+  // cosmiconfig new maintainer (replaced davidtheclark)
+  'd-fischer',
+  // find-root: jden renamed their npm account
+  'jsdnxx',
+  // Express.js core team (replaced ulisesgascon on express@5)
+  'jonchurch',
+  // source-map maintainer, Mozilla engineer (replaced nickfitzgerald)
+  'tromey',
+  // async: long-standing transfer from aearly
+  'hargasinski',
+  // http-proxy: known contributor, took over from indexzero
+  'jcrugzz',
+  // prebuild-install: known npm ecosystem contributor, took over from lovell
+  'vweevers',
 ]);
 
 export function classifyPublisherChange(from, to) {