forged-cli 0.4.0 → 0.4.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Brandon Kelly
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -43,10 +43,10 @@ forged readme
 `forged scan [path]` audits every package in your `package-lock.json`:
 
 - **Known malware** — checked against [OSV.dev](https://osv.dev), including OpenSSF `MAL-` reports and GitHub malware advisories (CWE-506)
-- **Brand-new versions** — flags versions published in the last 72 hours, the window when hijacked releases usually go unnoticed
+- **Brand-new versions** — flags versions published in the last 72 hours, the window when hijacked releases usually go unnoticed (packages that routinely release every week or two, like `caniuse-lite`, are skipped)
 - **Tarball integrity** — lockfile hashes vs. the npm registry
-- **Publisher changes** — flags a version published by a different account than the one before it (known maintainer rotations are suppressed)
-- **Typosquats** — names one or two characters away from popular packages
+- **Publisher changes** — flags a version whose publisher has never released this package before. Returning maintainers, known teams, and moves to npm trusted publishing are suppressed; security-critical packages like `jsonwebtoken` and `bcrypt` are always flagged for review
+- **Typosquats** — names one or two characters away from popular packages (one for short names, so `tsx` isn't mistaken for `nx`)
 - **Suspicious install scripts** — `curl | sh`, `eval`, base64 decoding and similar
 
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forged-cli",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "A complete dev environment toolkit — shell, workflows, and project scaffolding in one install.",
   "keywords": [
     "cli",

package/src/commands/scan.js

@@ -232,7 +232,7 @@ export async function scanCommand(cwd = process.cwd(), opts = {}) {
 
   // Verbose: show suppressed trusted rotations
   if (verbose && findings.suppressed.length > 0) {
-    console.log(`${bold}SUPPRESSED — trusted publisher rotations:${reset}`);
+    console.log(`${bold}SUPPRESSED — trusted, returning, or trusted-publishing publishers:${reset}`);
     for (const s of findings.suppressed) {
       console.log(`  ${green}~${reset}  ${s.package}@${s.version}: ${s.message}`);
     }
@@ -244,7 +244,7 @@ export async function scanCommand(cwd = process.cwd(), opts = {}) {
   }
   if (findings.suppressed.length > 0) {
     const note = verbose ? '' : '  (run with --verbose to see them)';
-    console.log(`  ${green}ℹ${reset}  ${findings.suppressed.length} trusted publisher rotation(s) suppressed${note}`);
+    console.log(`  ${green}ℹ${reset}  ${findings.suppressed.length} publisher change(s) suppressed${note}`);
   }
   console.log();
 

package/src/utils/freshness.js

@@ -3,6 +3,13 @@
 // time to be vetted by the community yet.
 export const FRESH_HOURS = 72;
 
+// Packages that ship data updates every few days (caniuse-lite,
+// electron-to-chromium, ...) are always "fresh" — a hijack stands out as an
+// unexpected release, not another routine one.
+const ROUTINE_SAMPLE = 10;   // look at the last N releases before this one
+const ROUTINE_MIN = 5;       // need at least this many to judge cadence
+const ROUTINE_GAP_DAYS = 14; // median gap at or under this = routine
+
 // Returns hours since publish if the version is younger than `hours`, else null
 export function hoursSincePublish(time, version, now = Date.now(), hours = FRESH_HOURS) {
   const published = Date.parse(time?.[version]);
@@ -10,3 +17,21 @@ export function hoursSincePublish(time, version, now = Date.now(), hours = FRESH
   const age = (now - published) / 3_600_000;
   return age >= 0 && age < hours ? Math.floor(age) : null;
 }
+
+// True when the package normally publishes every couple of weeks or faster
+export function isRoutineRelease(time, version) {
+  const published = Date.parse(time?.[version]);
+  if (Number.isNaN(published)) return false;
+  const earlier = Object.entries(time)
+    .filter(([v]) => v !== 'created' && v !== 'modified' && v !== version)
+    .map(([, t]) => Date.parse(t))
+    .filter((t) => !Number.isNaN(t) && t < published)
+    .sort((a, b) => a - b)
+    .slice(-ROUTINE_SAMPLE);
+  if (earlier.length < ROUTINE_MIN) return false;
+
+  const stamps = [...earlier, published];
+  const gaps = stamps.slice(1).map((t, i) => t - stamps[i]).sort((a, b) => a - b);
+  const median = gaps[Math.floor(gaps.length / 2)];
+  return median <= ROUTINE_GAP_DAYS * 86_400_000;
+}

package/src/utils/levenshtein.js

@@ -12,12 +12,17 @@ export function levenshtein(a, b) {
   return dp[m][n];
 }
 
+// Names this short are within 2 edits of lots of unrelated packages
+// (tsx → nx, ws, tar), so only a 1-character difference counts for them.
+const SHORT_NAME = 4;
+
 export function isSuspiciousName(name, popularPackages, threshold = 2) {
   const suspects = [];
   for (const known of popularPackages) {
     if (name === known) continue;
+    const limit = Math.min(name.length, known.length) <= SHORT_NAME ? Math.min(threshold, 1) : threshold;
     const dist = levenshtein(name, known);
-    if (dist > 0 && dist <= threshold) {
+    if (dist > 0 && dist <= limit) {
       suspects.push({ known, distance: dist });
     }
   }

package/src/utils/semver.js

@@ -0,0 +1,48 @@
+// Minimal semver ordering — enough to find "the version before this one".
+// Registry `versions` keys are in publish order, so a backport (e.g. 0.34.3
+// published after 0.41.1) would otherwise look like 0.41.2's predecessor.
+
+function parse(v) {
+  const [core, pre = ''] = String(v).split('+')[0].split(/-(.*)/s);
+  const nums = core.split('.').map((n) => Number.parseInt(n, 10) || 0);
+  return { nums: [nums[0] ?? 0, nums[1] ?? 0, nums[2] ?? 0], pre };
+}
+
+function comparePre(a, b) {
+  if (a === b) return 0;
+  if (!a) return 1; // release sorts after its prereleases
+  if (!b) return -1;
+  const as = a.split('.'), bs = b.split('.');
+  for (let i = 0; i < Math.max(as.length, bs.length); i++) {
+    if (as[i] === undefined) return -1;
+    if (bs[i] === undefined) return 1;
+    const an = /^\d+$/.test(as[i]), bn = /^\d+$/.test(bs[i]);
+    if (an && bn) {
+      const d = Number(as[i]) - Number(bs[i]);
+      if (d) return Math.sign(d);
+    } else if (an !== bn) {
+      return an ? -1 : 1; // numeric identifiers sort before alphanumeric
+    } else if (as[i] !== bs[i]) {
+      return as[i] < bs[i] ? -1 : 1;
+    }
+  }
+  return 0;
+}
+
+export function compareVersions(a, b) {
+  const pa = parse(a), pb = parse(b);
+  for (let i = 0; i < 3; i++) {
+    const d = pa.nums[i] - pb.nums[i];
+    if (d) return Math.sign(d);
+  }
+  return comparePre(pa.pre, pb.pre);
+}
+
+// Highest version strictly below `version`. Stable releases skip prereleases.
+export function previousVersion(versions, version) {
+  const isPre = parse(version).pre !== '';
+  return versions
+    .filter((v) => compareVersions(v, version) < 0 && (isPre || parse(v).pre === ''))
+    .sort(compareVersions)
+    .at(-1) ?? null;
+}

package/src/utils/trustedPublishers.js

@@ -57,6 +57,10 @@ export const TRUSTED_COMMUNITY = new Set([
   'jcrugzz',
   // prebuild-install: known npm ecosystem contributor, took over from lovell
   'vweevers',
+  // Fastify core team (safe-regex2 and other fastify-org packages)
+  'climba03003',
+  // Better Auth team — now maintains Auth.js / @auth/core
+  'better-gustavo', 'bekacru',
   // Expo core team (bot → human publisher rotations)
   'brentvatne', 'alanhughes', 'kudochien', 'philpl',
   // Software Mansion team (React Native Reanimated / Screens / Worklets)
@@ -67,6 +71,25 @@ export const TRUSTED_COMMUNITY = new Set([
   'flowtype',
 ]);
 
+// Security-critical packages: any publisher change gets a human look, even
+// from a returning maintainer (e.g. jsonwebtoken, julien.wollscheid).
+export const ALWAYS_REVIEW = new Set([
+  'jsonwebtoken', 'jose', 'bcrypt', 'bcryptjs', 'argon2',
+  'node-forge', 'crypto-js', 'tweetnacl', 'express-session', 'cookie-session',
+]);
+
+// "GitHub Actions" as publisher = npm trusted publishing (OIDC from CI)
+const TRUSTED_PUBLISHING = 'GitHub Actions';
+
+// → { type: 'warn' | 'info', reason: 'review' | 'oidc' | 'returning' | 'trusted' | 'new' }
+export function publisherChangeSeverity({ pkg, from, to, returning }) {
+  if (ALWAYS_REVIEW.has(pkg)) return { type: 'warn', reason: 'review' };
+  if (to === TRUSTED_PUBLISHING) return { type: 'info', reason: 'oidc' };
+  if (returning) return { type: 'info', reason: 'returning' };
+  const type = classifyPublisherChange(from, to);
+  return { type, reason: type === 'info' ? 'trusted' : 'new' };
+}
+
 export function classifyPublisherChange(from, to) {
   const fromTrusted = NPM_TEAM.has(from) || TRUSTED_COMMUNITY.has(from);
   const toTrusted   = NPM_TEAM.has(to)   || TRUSTED_COMMUNITY.has(to);

package/src/utils/verifyIntegrity.js

@@ -1,7 +1,8 @@
 import { readFileSync, existsSync } from 'fs';
 import { join } from 'path';
-import { classifyPublisherChange } from './trustedPublishers.js';
-import { hoursSincePublish, FRESH_HOURS } from './freshness.js';
+import { publisherChangeSeverity } from './trustedPublishers.js';
+import { hoursSincePublish, isRoutineRelease, FRESH_HOURS } from './freshness.js';
+import { previousVersion } from './semver.js';
 
 // Fetch registry metadata with a simple in-memory cache to avoid duplicate requests
 const registryCache = new Map();
@@ -111,7 +112,7 @@ export async function verifyTarballIntegrity(cwd, onProgress) {
 
       // Brand-new versions haven't been vetted yet — the usual window for hijacks
       const ageHours = hoursSincePublish(registryMeta.time, meta.version);
-      if (ageHours !== null) {
+      if (ageHours !== null && !isRoutineRelease(registryMeta.time, meta.version)) {
         findings.push({
           type: 'warning',
           package: name,
@@ -121,20 +122,33 @@ export async function verifyTarballIntegrity(cwd, onProgress) {
       }
 
       // Check if the author/publisher changed in this version vs the previous one
-      const versions = Object.keys(registryMeta.versions || {});
-      const idx = versions.indexOf(meta.version);
-      if (idx > 0) {
-        const prevVersion    = versions[idx - 1];
-        const prevPublisher  = registryMeta.versions[prevVersion]?._npmUser?.name;
-        const currPublisher  = versionData._npmUser?.name;
+      // Compare by version number, not registry order — backports would
+      // otherwise look like the previous release.
+      const allVersions = Object.keys(registryMeta.versions || {});
+      const prevVersion = previousVersion(allVersions, meta.version);
+      if (prevVersion) {
+        const prevPublisher = registryMeta.versions[prevVersion]?._npmUser?.name;
+        const currPublisher = versionData._npmUser?.name;
         if (prevPublisher && currPublisher && prevPublisher !== currPublisher) {
-          const severity = classifyPublisherChange(prevPublisher, currPublisher);
-          findings.push({
-            type: severity,
-            package: name,
-            version: meta.version,
-            message: `Publisher changed from "${prevPublisher}" to "${currPublisher}" in this version`,
+          // An account that already published an earlier version is a returning
+          // maintainer. The hijack pattern is a first-time publisher.
+          const publishedAt = Date.parse(registryMeta.time?.[meta.version]);
+          const returning = allVersions.some((v) =>
+            v !== meta.version &&
+            registryMeta.versions[v]?._npmUser?.name === currPublisher &&
+            Date.parse(registryMeta.time?.[v]) < publishedAt);
+          const { type, reason } = publisherChangeSeverity({
+            pkg: name, from: prevPublisher, to: currPublisher, returning,
           });
+          const change = `Publisher changed from "${prevPublisher}" to "${currPublisher}"`;
+          const message = {
+            review:    `${change} — security-critical package, review this release`,
+            oidc:      `Moved from "${prevPublisher}" to npm trusted publishing (GitHub Actions)`,
+            returning: `${change} (returning maintainer)`,
+            trusted:   `${change} (trusted publisher)`,
+            new:       `${change} — first release by this account`,
+          }[reason];
+          findings.push({ type, package: name, version: meta.version, message });
         }
       }
     }));