np-audit 2.1.0 → 2.2.0

package/README.md

@@ -11,7 +11,7 @@
 
 Static security analysis for npm packages — detects obfuscated lifecycle scripts, known vulnerabilities, and malicious patterns **before** they run. Drop-in replacement for `npm install` and `npm ci`.
 
-**Zero dependencies.** Pure Node.js built-ins only.
+**Zero dependencies.** Pure Node.js built-ins only. **< 100 kB** on the wire.
 
 ```bash
 npx np-audit scan express

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "np-audit",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "description": "Static obfuscation detector for npm lifecycle scripts — supply chain attack prevention",
   "bin": {
     "npa": "bin/npa.js",
@@ -13,7 +13,8 @@
     "README.md"
   ],
   "scripts": {
-    "test": "node test/index.js"
+    "test": "node test/index.js",
+    "coverage": "npx c8@11.0.0 --reporter=lcov --reporter=text-summary node test/index.js"
   },
   "engines": {
     "node": ">=18.0.0"
@@ -32,5 +33,8 @@
   "repository": {
     "type": "git",
     "url": "git+https://github.com/KoblerS/np-audit.git"
+  },
+  "dependencies": {
+    "c8": "^11.0.0"
   }
 }

package/src/commands/ci.js

@@ -32,7 +32,9 @@ module.exports = {
   async run({ flags, config, cwd }) {
     const spinner = !flags.json && !config.silent ? output.createSpinner('Auditing packages...') : null;
     if (spinner) spinner.start();
+    const t0 = Date.now();
     const results = await scan({ cwd, config, noDev: flags.noDev, verbose: flags.verbose });
+    const elapsedMs = Date.now() - t0;
     if (spinner) spinner.stop();
     const hasIssues = results.some(r => r.verdict !== 'OK');
     const silent = config.silent && !hasIssues;
@@ -43,6 +45,7 @@ module.exports = {
       process.stdout.write(JSON.stringify(toJsonReport(results), null, 2) + '\n');
     } else {
       printResults(results, silent);
+      if (!silent) output.printSummary(results, elapsedMs);
     }
 
     const blocked = results.filter(r => r.verdict === 'BLOCK');

package/src/commands/install.js

@@ -35,6 +35,7 @@ module.exports = {
 
     const spinner = !flags.json && !config.silent ? output.createSpinner('Auditing packages...') : null;
     if (spinner) spinner.start();
+    const t0 = Date.now();
     const results = await scan({
       cwd,
       config,
@@ -42,6 +43,7 @@ module.exports = {
       verbose:       flags.verbose,
       packages:      packages.length > 0 ? packages : null,
     });
+    const elapsedMs = Date.now() - t0;
     if (spinner) spinner.stop();
 
     const hasIssues = results.some(r => r.verdict !== 'OK');
@@ -53,6 +55,7 @@ module.exports = {
       process.stdout.write(JSON.stringify(toJsonReport(results), null, 2) + '\n');
     } else {
       printResults(results, silent);
+      if (!silent) output.printSummary(results, elapsedMs);
     }
 
     const blocked = results.filter(r => r.verdict === 'BLOCK');

package/src/commands/scan.js

@@ -33,7 +33,9 @@ module.exports = {
     const packages = args.filter(a => !a.startsWith('-'));
     const spinner = !flags.json && !config.silent ? output.createSpinner('Auditing packages...') : null;
     if (spinner) spinner.start();
+    const t0 = Date.now();
     const results = await scan({ cwd, config, noDev: flags.noDev, verbose: flags.verbose, packages: packages.length > 0 ? packages : null });
+    const elapsedMs = Date.now() - t0;
     if (spinner) spinner.stop();
     const hasIssues = results.some(r => r.verdict !== 'OK');
     const silent = config.silent && !hasIssues;
@@ -47,7 +49,7 @@ module.exports = {
     }
 
     printResults(results, silent);
-    if (!silent) output.printSummary(results);
+    if (!silent) output.printSummary(results, elapsedMs);
 
     const hasBlock = results.some(r => r.verdict === 'BLOCK');
     process.exit(hasBlock ? 1 : 0);

package/src/core/scanner.js

@@ -651,6 +651,17 @@ function extractSemver(range) {
   return null;
 }
 
+/**
+ * Resolve an extracted (possibly partial) version to a full version using registry metadata.
+ * Falls back to dist-tags.latest when the partial version doesn't match any published version.
+ */
+function resolveVersion(extracted, meta) {
+  if (meta.versions && meta.versions[extracted]) return extracted;
+  const latest = meta['dist-tags'] && meta['dist-tags'].latest;
+  if (latest && meta.versions && meta.versions[latest]) return latest;
+  return null;
+}
+
 /**
  * Resolve dependencies from package.json when no lockfile exists.
  * @param {string} cwd
@@ -687,12 +698,13 @@ async function resolveFromPackageJson(cwd, config, noDev) {
     try {
       const encodedName = name.startsWith('@') ? `@${encodeURIComponent(name.slice(1))}` : encodeURIComponent(name);
       const meta = await fetchJSON(`${config.registry}/${encodedName}`, { timeout: config.timeout });
-      const versionData = meta.versions && meta.versions[version];
-      if (!versionData) continue;
+      const resolvedVersion = resolveVersion(version, meta);
+      if (!resolvedVersion) continue;
+      const versionData = meta.versions[resolvedVersion];
 
       packages.push({
         name,
-        version,
+        version: resolvedVersion,
         resolved: versionData.dist && versionData.dist.tarball,
         integrity: versionData.dist && versionData.dist.integrity || '',
         hasInstallScript: !!(versionData.scripts &&
@@ -752,22 +764,25 @@ async function resolveSinglePackage(packageSpec, config) {
     for (const [depName] of queue) seen.add(depName);
 
     const resolutions = await mapWithConcurrency(queue, config.parallelFetches, async ([depName, range]) => {
-      const exactVersion = extractSemver(range);
-      if (!exactVersion) return null;
+      const extractedVersion = extractSemver(range);
+      if (!extractedVersion) return null;
 
       let depScripts = false;
       let depDeps = null;
-      let depTarball = buildTarballUrl(depName, exactVersion, config.registry);
+      let depTarball = buildTarballUrl(depName, extractedVersion, config.registry);
       let depIntegrity = '';
+      let resolvedDepVersion = extractedVersion;
 
       try {
         const encodedDep = depName.startsWith('@') ? `@${encodeURIComponent(depName.slice(1))}` : encodeURIComponent(depName);
         const depMeta = await fetchJSON(`${config.registry}/${encodedDep}`, { timeout: config.timeout });
-        const depData = depMeta.versions && depMeta.versions[exactVersion];
+        const fullVersion = resolveVersion(extractedVersion, depMeta);
+        const depData = fullVersion && depMeta.versions && depMeta.versions[fullVersion];
         if (depData) {
+          resolvedDepVersion = fullVersion;
           depScripts = !!(depData.scripts &&
             (depData.scripts.preinstall || depData.scripts.postinstall || depData.scripts.install));
-          depTarball = depData.dist && depData.dist.tarball || depTarball;
+          depTarball = depData.dist && depData.dist.tarball || buildTarballUrl(depName, fullVersion, config.registry);
           depIntegrity = depData.dist && depData.dist.integrity || '';
           depDeps = depData.dependencies;
         }
@@ -778,7 +793,7 @@ async function resolveSinglePackage(packageSpec, config) {
       return {
         pkg: {
           name:             depName,
-          version:          exactVersion,
+          version:          resolvedDepVersion,
           resolved:         depTarball,
           integrity:        depIntegrity,
           hasInstallScript: depScripts,
@@ -837,4 +852,4 @@ async function mapWithConcurrency(items, limit, fn) {
   return results;
 }
 
-module.exports = { scan, hasInstallScripts, extractScriptFileFromCommand, verdictFromScore };
+module.exports = { scan, hasInstallScripts, extractScriptFileFromCommand, verdictFromScore, resolveVersion, extractSemver };

package/src/utils/output.js

@@ -90,15 +90,16 @@ function printPackageResult(pkg, result) {
   }
 }
 
-function printSummary(results) {
+function printSummary(results, elapsedMs) {
   const blocked = results.filter(r => r.verdict === 'BLOCK').length;
   const warned  = results.filter(r => r.verdict === 'WARN').length;
   const total   = results.totalPackages || results.length;
   const ok      = total - blocked - warned;
+  const timing  = elapsedMs != null ? dim(`  (${elapsedMs}ms)`) : '';
 
   log('');
   log(dim('─'.repeat(60)));
-  log(`  ${green(String(ok))} clean   ${yellow(String(warned))} warnings   ${red(String(blocked))} blocked`);
+  log(`  ${green(String(ok))} clean   ${yellow(String(warned))} warnings   ${red(String(blocked))} blocked${timing}`);
   log('');
 }