npq 2.0.22 → 2.1.0

package/README.md

@@ -19,13 +19,14 @@
 
 
 Media coverage about npq:
+- As mentioned on [Thomas Gentilhomme](https://github.com/fraxken)'s French book of [Become a Node.js Developer](https://docs.google.com/document/d/1JHgmEFkc8Py4XSuCB8_DQ5FFEJoogyeninFK6ucTd4o/edit#) 
 - Tao Bojlén's [A web of trust for npm](https://www.btao.org/2020/10/02/npm-trust.html)
 - Zander's [favorite list of command line tools](https://zander.wtf/blog/terminal-commands)
 - Ran Bar Zik's [npq review to install safe modules](https://internet-israel.com/%D7%A4%D7%99%D7%AA%D7%95%D7%97-%D7%90%D7%99%D7%A0%D7%98%D7%A8%D7%A0%D7%98/%D7%91%D7%A0%D7%99%D7%99%D7%AA-%D7%90%D7%AA%D7%A8%D7%99-%D7%90%D7%99%D7%A0%D7%98%D7%A8%D7%A0%D7%98-%D7%9C%D7%9E%D7%A4%D7%AA%D7%97%D7%99%D7%9D/%D7%91%D7%93%D7%99%D7%A7%D7%94-%D7%A2%D7%9D-npq-%D7%9B%D7%93%D7%99-%D7%9C%D7%95%D7%95%D7%93%D7%90-%D7%94%D7%AA%D7%A7%D7%A0%D7%94-%D7%AA%D7%A7%D7%99%D7%A0%D7%94-%D7%A9%D7%9C-%D7%9E%D7%95%D7%93%D7%95/)
 - ostechnix's [How To Safely Install Packages Using Npm Or Yarn On Linux](https://ostechnix.com/how-to-safely-install-packages-using-npm-or-yarn-on-linux)
 - debricked's [How to evaluate the security of your NPM Package dependencies](https://debricked.com/blog/2020/03/11/how-to-evaluate-the-security-of-your-npm-package-dependencies)
-- JavaScript January advent calendar's post on [Open Source From Heaven, Modules From Hell](https://www.javascriptjanuary.com/blog/open-source-from-heaven-modules-from-hell)
-- Liran Tal's [Malicious Modules — what you need to know when installing npm packages](https://medium.com/@liran.tal/malicious-modules-what-you-need-to-know-when-installing-npm-packages-12b2f56d3685)
+- JavaScript January advent calendar's post on [Open Source From Heaven, Modules From Hell](https://www.lirantal.com/blog/2019-01-26)
+- Liran Tal's [Malicious Modules — what you need to know when installing npm packages](https://www.lirantal.com/blog/malicious-modules-what-you-need-to-know-when-installing-npm-packages-12b2f56d3685)
 
 
 ## About
@@ -90,8 +91,10 @@ Note: `npq` by default will offload all commands and their arguments to the `npm
 | Marshall Name | Description | Notes
 | --- | --- | ---
 | age | Will show a warning for a package if its age on npm is less than 22 days | Checks a package creation date, not a specific version
+| author | Will show a warning if a package has been found without an author field | Checks the latest version for an author
 | downloads | Will show a warning for a package if its download count in the last month is less than 20
 | readme | Will show a warning if a package has no README or it has been detected as a security placeholder package by npm staff
+| repo | Will show a warning if a package has been found without a valid and working repository URL | Checks the latest version for a repository URL
 | scripts | Will show a warning if a package has a pre/post install script which could potentially be malicious
 | snyk | Will show a warning if a package has been found with vulnerabilities in snyk's database | For snyk to work you need to either have the `snyk` npm package installed with a valid api token, or make the token available in the SNYK_TOKEN environment variable, and npq will use it
 | license | Will show a warning if a package has been found without a license field | Checks the latest version for a license
@@ -106,6 +109,12 @@ Example, to disable snyk:
 MARSHALL_DISABLE_SNYK=1 npq install express
 ```
 
+### Run checks on package without installing it:
+
+```sh
+npq install express --dry-run
+```
+
 ### Using with TravisCI
 
 An example of using lockfile-lint with a `.travis.yml` configuration as part of your build:

package/__tests__/scripts.test.js

@@ -13,11 +13,14 @@ inquirer.prompt = jest.fn().mockResolvedValue({ install: true })
 
 let mockGetShellConfig
 let mockIsRunningInYarn
+let mockGetNpmVersion
 
 beforeEach(() => {
   mockGetShellConfig = jest.spyOn(helpers, 'getShellConfig').mockImplementation(() => ({ name: 'testShell', profilePath: TEST_PROFILE_PATH, aliases: TEST_ALIAS }))
   // Our install script does not run when installing with yarn, but we still want to be able to run tests with yarn
   mockIsRunningInYarn = jest.spyOn(helpers, 'isRunningInYarn').mockImplementation(() => false)
+  // Our install script does not run when installing with npm V7, but we still want to be able to run tests with all npm versions
+  mockGetNpmVersion = jest.spyOn(helpers, 'getNpmVersion').mockImplementation(() => '6.0.0')
 })
 
 afterEach(async () => {
@@ -57,6 +60,22 @@ test('postinstall script does not run in yarn', async () => {
   spy.mockRestore()
 })
 
+test('postinstall script does not run in npm v7', async () => {
+  // npm v7 does not allow for stdin input during `npm install [-g] npq`
+  mockGetNpmVersion.mockRestore()
+  const oldUserAgent = process.env.npm_config_user_agent
+
+  const spy = jest.spyOn(console, 'log')
+  // pretend that we're running in npm v7, whether or not we actually are
+  process.env.npm_config_user_agent = 'npm/7.19.1 node/v14.16.1 win32 x64 workspaces/false'
+
+  await postinstall.runPostInstall()
+  expect(spy).not.toHaveBeenCalled()
+
+  process.env.npm_config_user_agent = oldUserAgent
+  spy.mockRestore()
+})
+
 test('postinstall script adds aliases', async () => {
   await postinstall.runPostInstall()
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "2.0.22",
+  "version": "2.1.0",
   "description": "marshall your npm/yarn package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",
@@ -172,15 +172,15 @@
   },
   "dependencies": {
     "chalk": "^2.3.0",
-    "glob": "^7.1.7",
+    "glob": "^8.0.3",
     "inquirer": "^7.3.3",
     "listr": "^0.14.0",
-    "node-fetch": "^2.6.1",
-    "npm-package-arg": "^8.1.4",
-    "semver": "^6.3.0",
-    "update-notifier": "^5.0.1",
+    "node-fetch": "^2.6.7",
+    "npm-package-arg": "^10.1.0",
+    "semver": "^7.3.8",
+    "update-notifier": "^6.0.2",
     "validator": "^13.6.0",
-    "yargs": "^16.2.0"
+    "yargs": "^17.6.2"
   },
   "release": {
     "branch": "master",

package/scripts/postinstall.js

@@ -1,6 +1,7 @@
 const fs = require('fs')
 const chalk = require('chalk')
 const inquirer = require('inquirer')
+const semver = require('semver')
 
 const helpers = require('./scriptHelpers')
 
@@ -10,6 +11,11 @@ const runPostInstall = async () => {
     return
   }
 
+  if (semver.gte(helpers.getNpmVersion(), '7.0.0')) {
+    // `npm install` in npm v7 cannot get stdin input, so we can't run this script there
+    return
+  }
+
   const shellConfig = helpers.getShellConfig()
   if (!shellConfig) {
     console.log('Could not detect your shell; please add aliases for npq manually.')

package/scripts/scriptHelpers.js

@@ -1,6 +1,7 @@
 const fs = require('fs')
 const os = require('os')
 const path = require('path')
+const semver = require('semver')
 
 const BASH_ZSH_ALIASES = '\nalias npm="npq-hero"\nalias yarn="NPQ_PKG_MGR=yarn npq-hero"\n'
 const SHELLS = {
@@ -47,6 +48,12 @@ module.exports.isRunningInYarn = () => {
   return binaryName.toLowerCase().includes('yarn')
 }
 
+module.exports.getNpmVersion = () => {
+  const npmData = process.env['npm_config_user_agent'] || '0.0.0'
+  const version = /npm\/(.*) node/.exec(npmData)[1]
+  return semver.valid(version) ? version : '0.0.0'
+}
+
 const getProfile = async (profilePath) => {
   try {
     // eslint-disable-next-line security/detect-non-literal-fs-filename