npmguard-cli 0.1.0 → 0.2.0

package/dist/commands/check.js

@@ -2,26 +2,36 @@ import chalk from "chalk";
 import Table from "cli-table3";
 import ora from "ora";
 import { scanProject } from "../scanner.js";
+const IPFS_GATEWAY = "https://gateway.pinata.cloud/ipfs";
 function verdictLabel(verdict, score) {
     switch (verdict) {
         case "SAFE":
-            return chalk.green(`✅ SAFE (${score})`);
+            return chalk.green(`SAFE (${score})`);
         case "WARNING":
-            return chalk.yellow(`⚠️  WARNING (${score})`);
+            return chalk.yellow(`WARNING (${score})`);
         case "CRITICAL":
-            return chalk.red(`❌ CRITICAL (${score})`);
+            return chalk.red(`CRITICAL (${score})`);
         default:
-            return chalk.gray("❓ UNKNOWN");
+            return chalk.gray("UNKNOWN");
     }
 }
-function reportLink(audit) {
-    if (audit.reportCid) {
-        return chalk.gray(`  📄 Report: https://gateway.pinata.cloud/ipfs/${audit.reportCid}`);
-    }
-    return "";
+function capsLabel(caps) {
+    if (caps.length === 0)
+        return chalk.gray("none");
+    return caps
+        .map((c) => {
+        if (["process_spawn", "binary_download", "eval_usage", "obfuscated_code"].includes(c)) {
+            return chalk.red(c);
+        }
+        if (["filesystem"].includes(c)) {
+            return chalk.yellow(c);
+        }
+        return chalk.gray(c);
+    })
+        .join(", ");
 }
-function npmLink(name, version) {
-    return chalk.gray(`  📦 https://www.npmjs.com/package/${name}/v/${version}`);
+function shortCid(cid) {
+    return cid.slice(0, 8) + "..." + cid.slice(-4);
 }
 export async function checkCommand(projectPath, auditSource) {
     const spinner = ora("Scanning project dependencies...").start();
@@ -32,7 +42,8 @@ export async function checkCommand(projectPath, auditSource) {
             chalk.bold("Package"),
             chalk.bold("Installed"),
             chalk.bold("Latest"),
-            chalk.bold("NpmGuard Verdict"),
+            chalk.bold("Verdict"),
+            chalk.bold("Capabilities"),
         ],
         style: { head: [], border: [] },
     });
@@ -40,60 +51,47 @@ export async function checkCommand(projectPath, auditSource) {
     let warningCount = 0;
     let criticalCount = 0;
     let notAuditedCount = 0;
-    const details = [];
+    const links = [];
     for (const dep of deps) {
         const versionToCheck = dep.latest ?? dep.installed;
-        const audit = await auditSource.getAudit(dep.name, versionToCheck);
-        let verdictCol;
+        let audit;
         if (!dep.hasUpdate) {
-            const currentAudit = await auditSource.getAudit(dep.name, dep.installed);
-            if (currentAudit) {
-                verdictCol = verdictLabel(currentAudit.verdict, currentAudit.score);
-                if (currentAudit.verdict === "SAFE")
-                    safeCount++;
-                else if (currentAudit.verdict === "WARNING") {
-                    warningCount++;
-                    details.push(reportLink(currentAudit));
-                }
-                else if (currentAudit.verdict === "CRITICAL") {
-                    criticalCount++;
-                    details.push(reportLink(currentAudit));
-                }
-            }
-            else {
-                verdictCol = chalk.gray("❓ NOT AUDITED");
-                notAuditedCount++;
-                details.push(npmLink(dep.name, dep.installed));
-            }
+            audit = await auditSource.getAudit(dep.name, dep.installed);
+        }
+        else {
+            audit = await auditSource.getAudit(dep.name, versionToCheck);
         }
-        else if (audit) {
+        let verdictCol;
+        let capsCol;
+        if (audit) {
             verdictCol = verdictLabel(audit.verdict, audit.score);
+            capsCol = capsLabel(audit.capabilities);
             if (audit.verdict === "SAFE")
                 safeCount++;
-            else if (audit.verdict === "WARNING") {
+            else if (audit.verdict === "WARNING")
                 warningCount++;
-                details.push(reportLink(audit));
-            }
-            else if (audit.verdict === "CRITICAL") {
+            else if (audit.verdict === "CRITICAL")
                 criticalCount++;
-                details.push(reportLink(audit));
+            if (audit.reportCid) {
+                links.push(`  ${dep.name}@${versionToCheck} report: ${IPFS_GATEWAY}/${audit.reportCid}`);
             }
         }
         else {
-            verdictCol = chalk.gray("❓ NOT AUDITED");
+            verdictCol = chalk.gray("NOT AUDITED");
+            capsCol = chalk.gray("-");
             notAuditedCount++;
-            details.push(npmLink(dep.name, versionToCheck));
         }
         table.push([
             dep.name,
             dep.installed,
             dep.latest ?? dep.installed,
             verdictCol,
+            capsCol,
         ]);
     }
     spinner.stop();
     console.log();
-    console.log(chalk.bold("📦 NpmGuard Dependency Audit"));
+    console.log(chalk.bold("NpmGuard Dependency Audit"));
     console.log();
     console.log(table.toString());
     console.log();
@@ -107,18 +105,16 @@ export async function checkCommand(projectPath, auditSource) {
         parts.push(chalk.red(`${criticalCount} critical`));
     if (notAuditedCount > 0)
         parts.push(chalk.gray(`${notAuditedCount} not audited`));
-    console.log(`  ${parts.join(" · ")}`);
-    // Show detail links
-    if (details.length > 0) {
+    console.log(`  ${parts.join(" | ")}`);
+    if (links.length > 0) {
         console.log();
-        for (const d of details) {
-            if (d)
-                console.log(d);
+        for (const link of links) {
+            console.log(chalk.gray(link));
         }
     }
     if (criticalCount > 0) {
         console.log();
-        console.log(chalk.red.bold(`  ⛔ ${criticalCount} package(s) flagged as CRITICAL — do not update without reviewing the report.`));
+        console.log(chalk.red.bold(`  ${criticalCount} package(s) flagged as CRITICAL — do not update without reviewing the report.`));
     }
     console.log();
 }

package/dist/commands/install.d.ts

@@ -1,2 +1,2 @@
 import type { AuditSource } from "../audit-source.js";
-export declare function installCommand(packageSpec: string, auditSource: AuditSource): Promise<void>;
+export declare function installCommand(packageSpec: string, auditSource: AuditSource, force?: boolean): Promise<void>;

package/dist/commands/install.js

@@ -1,8 +1,8 @@
 import chalk from "chalk";
 import ora from "ora";
 import { execSync } from "node:child_process";
-export async function installCommand(packageSpec, auditSource) {
-    // Parse package@version or just package
+const IPFS_GATEWAY = "https://gateway.pinata.cloud/ipfs";
+export async function installCommand(packageSpec, auditSource, force = false) {
     const atIndex = packageSpec.lastIndexOf("@");
     let packageName;
     let requestedVersion = null;
@@ -14,7 +14,6 @@ export async function installCommand(packageSpec, auditSource) {
         packageName = packageSpec;
     }
     const spinner = ora(`Checking audit for ${packageName}...`).start();
-    // Get latest version from npm if not specified
     if (!requestedVersion) {
         try {
             const resp = await fetch(`https://registry.npmjs.org/${packageName}/latest`);
@@ -24,7 +23,7 @@ export async function installCommand(packageSpec, auditSource) {
             }
         }
         catch {
-            // continue without version
+            // continue
         }
     }
     if (!requestedVersion) {
@@ -33,46 +32,58 @@ export async function installCommand(packageSpec, auditSource) {
     }
     const audit = await auditSource.getAudit(packageName, requestedVersion);
     spinner.stop();
+    console.log();
+    console.log(chalk.bold(`  ${packageName}@${requestedVersion}`));
+    console.log();
     if (!audit) {
+        console.log(chalk.gray(`  NOT AUDITED — no NpmGuard record found for this version.`));
+        console.log(chalk.gray(`  https://www.npmjs.com/package/${packageName}/v/${requestedVersion}`));
         console.log();
-        console.log(chalk.gray(`  ❓ ${packageName}@${requestedVersion} has not been audited by NpmGuard.`));
         console.log(chalk.gray("  Proceeding with standard npm install..."));
         console.log();
         execSync(`npm install ${packageSpec}`, { stdio: "inherit" });
         return;
     }
-    console.log();
-    console.log(chalk.bold(`  📦 ${packageName}@${requestedVersion}`));
+    // Show verdict
+    if (audit.verdict === "SAFE") {
+        console.log(chalk.green(`  SAFE (score: ${audit.score})`));
+    }
+    else if (audit.verdict === "WARNING") {
+        console.log(chalk.yellow(`  WARNING (score: ${audit.score})`));
+    }
+    else if (audit.verdict === "CRITICAL") {
+        console.log(chalk.red(`  CRITICAL (score: ${audit.score})`));
+    }
+    // Show capabilities
+    if (audit.capabilities.length > 0) {
+        console.log(chalk.gray(`  Capabilities: ${audit.capabilities.join(", ")}`));
+    }
+    // Show IPFS links
+    if (audit.reportCid) {
+        console.log(chalk.gray(`  Report: ${IPFS_GATEWAY}/${audit.reportCid}`));
+    }
+    if (audit.sourceCid) {
+        console.log(chalk.gray(`  Source: ${IPFS_GATEWAY}/${audit.sourceCid}`));
+    }
     console.log();
     if (audit.verdict === "SAFE") {
-        console.log(chalk.green(`  ✅ SAFE (score: ${audit.score})`));
-        if (audit.capabilities.length > 0) {
-            console.log(chalk.gray(`  Capabilities: ${audit.capabilities.join(", ")}`));
-        }
-        console.log();
         execSync(`npm install ${packageSpec}`, { stdio: "inherit" });
     }
     else if (audit.verdict === "WARNING") {
-        console.log(chalk.yellow(`  ⚠️  WARNING (score: ${audit.score})`));
-        console.log(chalk.yellow(`  Capabilities: ${audit.capabilities.join(", ")}`));
-        if (audit.reportCid) {
-            console.log(chalk.gray(`  Report: https://gateway.pinata.cloud/ipfs/${audit.reportCid}`));
-        }
-        console.log();
         console.log(chalk.yellow("  Installing with warning..."));
         console.log();
         execSync(`npm install ${packageSpec}`, { stdio: "inherit" });
     }
     else if (audit.verdict === "CRITICAL") {
-        console.log(chalk.red(`  ❌ CRITICAL (score: ${audit.score})`));
-        console.log(chalk.red(`  Capabilities: ${audit.capabilities.join(", ")}`));
-        if (audit.reportCid) {
-            console.log(chalk.gray(`  Report: https://gateway.pinata.cloud/ipfs/${audit.reportCid}`));
+        if (force) {
+            console.log(chalk.red("  --force: Installing despite CRITICAL verdict..."));
+            console.log();
+            execSync(`npm install ${packageSpec}`, { stdio: "inherit" });
+        }
+        else {
+            console.log(chalk.red.bold("  Installation blocked. This package has critical security issues."));
+            console.log(chalk.gray("  Use --force to install anyway."));
+            console.log();
         }
-        console.log();
-        console.log(chalk.red.bold("  ⛔ Installation blocked. This package has critical security issues."));
-        console.log(chalk.gray("  Use --force to install anyway: npmguard install --force " +
-            packageSpec));
-        console.log();
     }
 }

package/dist/index.js

@@ -31,6 +31,6 @@ program
     const auditSource = opts.mock
         ? new MockAuditSource()
         : new ENSAuditSource();
-    await installCommand(pkg, auditSource);
+    await installCommand(pkg, auditSource, opts.force ?? false);
 });
 program.parse();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npmguard-cli",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Check npm packages against NpmGuard security audits on ENS before installing",
   "bin": {
     "npmguard-cli": "./dist/index.js"