npq 2.2.0 → 2.3.1

package/.github/workflows/main.yml

@@ -7,7 +7,7 @@ jobs:
     strategy:
       matrix:
         platform: [ubuntu-latest]
-        node: ['12', '14']
+        node: ['12', '14', '16', '18']
     name: Node ${{ matrix.node }} (${{ matrix.platform }})
     runs-on: ${{ matrix.platform }}
     steps:
@@ -37,13 +37,18 @@ jobs:
   release:
     name: do semantic release
     runs-on: 'ubuntu-latest'
+    permissions:
+      contents: write # to be able to publish a GitHub release
+      issues: write # to be able to comment on released issues
+      pull-requests: write # to be able to comment on released pull requests
+      id-token: write # to enable use of OIDC for npm provenance
     needs: build
-    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     steps:
       - uses: actions/checkout@v2
       - uses: actions/setup-node@v2
         with:
-          node-version: '14'
+          node-version: '18'
       - name: install dependencies
         run: yarn install --frozen-lockfile --ignore-engines --ignore-scripts
       - name: release

package/README.md

@@ -1,13 +1,13 @@
 <p align="center">
 	<br>
-  <img width="200" src="https://github.com/lirantal/npq/raw/master/.github/Logo%20Horizontal.png">
+  <img width="200" src="https://github.com/lirantal/npq/raw/main/.github/Logo%20Horizontal.png">
 	<br>
 	safely* install packages with npm/yarn by auditing them as part of your install process
 </p>
 
 [![npm](https://img.shields.io/npm/v/npq.svg)](https://www.npmjs.com/package/npq)
 [![npm](https://img.shields.io/npm/l/npq.svg)](https://www.npmjs.com/package/npq)
-[![codecov](https://codecov.io/gh/lirantal/npq/branch/master/graph/badge.svg)](https://codecov.io/gh/lirantal/npq)
+[![codecov](https://codecov.io/gh/lirantal/npq/branch/main/graph/badge.svg)](https://codecov.io/gh/lirantal/npq)
 [![Build Status](https://github.com/lirantal/npq/workflows/unit-tests/badge.svg)](https://github.com/lirantal/npq/workflows/unit-tests)
 [![Known Vulnerabilities](https://snyk.io/test/github/lirantal/npq/badge.svg)](https://snyk.io/test/github/lirantal/npq)
 [![Security Responsible Disclosure](https://img.shields.io/badge/Security-Responsible%20Disclosure-yellow.svg)](./SECURITY.md)
@@ -15,7 +15,7 @@
 
 [![npq](https://snyk.io/advisor/npm-package/npq/badge.svg)](https://snyk.io/advisor/npm-package/npq)
 
-![npq-demo-3-final](https://github.com/lirantal/npq/blob/master/.github/npq-demo.gif?raw=true)
+![npq-demo-3-final](https://github.com/lirantal/npq/blob/main/.github/npq-demo.gif?raw=true)
 
 
 Media coverage about npq:
@@ -96,14 +96,15 @@ Note: `npq` by default will offload all commands and their arguments to the `npm
 | readme | Will show a warning if a package has no README or it has been detected as a security placeholder package by npm staff
 | repo | Will show a warning if a package has been found without a valid and working repository URL | Checks the latest version for a repository URL
 | scripts | Will show a warning if a package has a pre/post install script which could potentially be malicious
-| snyk | Will show a warning if a package has been found with vulnerabilities in snyk's database | For snyk to work you need to either have the `snyk` npm package installed with a valid api token, or make the token available in the SNYK_TOKEN environment variable, and npq will use it
+| snyk | Will show a warning if a package has been found with vulnerabilities in Snyk's database | For Snyk to work you need to either have the `snyk` npm package installed with a valid api token, or make the token available in the SNYK_TOKEN environment variable, and npq will use it
 | license | Will show a warning if a package has been found without a license field | Checks the latest version for a license
+| expired domains | Will show a warning if a package has been found with one of its maintainers having an email address that includes an expired domain | Checks a dependency version for a maintainer with an expired domain
 
 ### Disabling Marshalls
 
 To disable a marshall altogether, set an environment variable using with the marshall's shortname.
 
-Example, to disable snyk:
+Example, to disable the Snyk vulnerability marshall:
 
 ```
 MARSHALL_DISABLE_SNYK=1 npq install express
@@ -134,14 +135,14 @@ script:
 * NPQ will audit a package for possible security issues, but it isn't a replacement for npm or yarn. When you choose to continue installing the package, it will offload the installation process to your choice of either npm or yarn.
 2. **How is NPQ different from npm audit?**
 * `npm install` will install a module even if it has vulnerabilities; NPQ will display the issues detected, and prompt the user for confirmation on whether to proceed installing it.
-* NPQ will run synthethic checks, called [marshalls](https://github.com/lirantal/npq#marshalls), on the characteristics of a module, such as whether the module you are going to install has a `pre-install` script which can be potentially harmful for your system and prompt you whether to install it. Whereas `npm audit` will not perform any such checks, and only consults a vulnerability database for known security issues.
-* `npm audit` is closer in functionality to what snyk does, rather than what NPQ does.
-3. **Do I require a snyk API key in order to use NPQ?**
-* It's not required. If NPQ is unable to detect a snyk API key for the user running NPQ, then it will skip the database vulnerabilities check. We do, however, greatly encourage you to use snyk, and connect it with NPQ for broader security.
+* NPQ will run synthetic checks, called [marshalls](https://github.com/lirantal/npq#marshalls), on the characteristics of a module, such as whether the module you are going to install has a `pre-install` script which can be potentially harmful for your system and prompt you whether to install it. Whereas `npm audit` will not perform any such checks, and only consults a vulnerability database for known security issues.
+* `npm audit` is closer in functionality to what Snyk does, rather than what NPQ does.
+3. **Do I require a Snyk API key in order to use NPQ?**
+* It's not required. If NPQ is unable to detect a Snyk API key for the user running NPQ, then it will skip the database vulnerabilities check. We do, however, greatly encourage you to use Snyk, and connect it with NPQ for broader security.
 
 ## Contributing
 
-Please consult the [CONTRIBUTING](https://github.com/lirantal/npq/blob/master/CONTRIBUTING.md) for guidelines on contributing to this project
+Please consult the [CONTRIBUTING](https://github.com/lirantal/npq/blob/main/CONTRIBUTING.md) for guidelines on contributing to this project
 
 ## Author
 Liran Tal <liran.tal@gmail.com>

package/__tests__/marshalls.base.test.js

@@ -27,7 +27,7 @@ test('checkPackage returns validation data if it was a success', async () => {
   expect(result).toEqual('validation-result')
 })
 
-test('checkPackage sets the error property if the validaiton failed', async () => {
+test('checkPackage sets the error property if the validation failed', async () => {
   const testMarshall = new TestMarshall({
     packageRepoUtils: null
   })

package/__tests__/marshalls.expiredDomains.test.js

@@ -0,0 +1,100 @@
+const ExpiredDomainsMarshall = require('../lib/marshalls/expiredDomains.marshall')
+
+const testMarshall = new ExpiredDomainsMarshall({
+  packageRepoUtils: {
+    getPackageInfo: (pkgInfo) => {
+      return new Promise((resolve) => {
+        resolve(pkgInfo)
+      })
+    }
+  }
+})
+
+describe('Expired domains test suites', () => {
+  beforeEach(() => {
+    jest.clearAllMocks()
+    jest.resetAllMocks()
+  })
+
+  test('has the right title', async () => {
+    expect(testMarshall.title()).toEqual('Detecting expired domains for authors account...')
+  })
+
+  test('throws the right error when an email domain cant be verified', async () => {
+    const nonExistentEmailAddress =
+      'liran.tal+test1234@somenonexistentdomainongoogle109dubv98g39ujasdasda.com'
+    const pkgData = {
+      packageName: {
+        'dist-tags': {
+          latest: '1.0.0'
+        },
+        versions: {
+          '1.0.0': {
+            maintainers: [
+              { name: 'lirantal', email: 'liran.tal@gmail.com' },
+              {
+                name: 'lirantal_test_user',
+                email: nonExistentEmailAddress
+              }
+            ]
+          }
+        }
+      }
+    }
+
+    await expect(testMarshall.validate(pkgData)).rejects.toThrow(
+      /Unable to resolve domain for maintainer e-mail, could be an expired account/
+    )
+  })
+
+  test('if email hostname is empty then show an unknown message', async () => {
+    const nonExistentEmailAddress = ''
+    const pkgData = {
+      packageName: {
+        'dist-tags': {
+          latest: '1.0.0'
+        },
+        versions: {
+          '1.0.0': {
+            maintainers: [
+              { name: 'lirantal', email: 'liran.tal@gmail.com' },
+              {
+                name: 'lirantal_test_user',
+                email: nonExistentEmailAddress
+              }
+            ]
+          }
+        }
+      }
+    }
+
+    await expect(testMarshall.validate(pkgData)).rejects.toThrow(
+      /Unable to resolve domain for maintainer e-mail, could be an expired account: <unknown>/
+    )
+  })
+
+  test('does not throw any errors if the domain resolves well', async () => {
+    jest.setTimeout(15000)
+
+    const pkgData = {
+      packageName: {
+        'dist-tags': {
+          latest: '1.0.0'
+        },
+        versions: {
+          '1.0.0': {
+            maintainers: [
+              { name: 'lirantal', email: 'liran.tal@gmail.com' },
+              {
+                name: 'lirantal_test_user',
+                email: 'liran.tal@gmail.com'
+              }
+            ]
+          }
+        }
+      }
+    }
+
+    await expect(testMarshall.validate(pkgData)).resolves.toEqual(expect.anything())
+  })
+})

package/__tests__/packageManager.test.js

@@ -59,7 +59,7 @@ test('package manager spawns successfully when provided array of packages to han
   childProcess.spawn.mockReset()
 })
 
-test('package manager spawns successfully and ignore npqs own internal commands when spawning package manager', async () => {
+test("package manager spawns successfully and ignore npq's own internal commands when spawning package manager", async () => {
   process.argv = [
     'node',
     'script name',

package/bin/npq-hero.js

@@ -43,7 +43,7 @@ marshall
   })
   .then((status) => {
     if (status && status.hasOwnProperty('install') && status.install === true) {
-      pkgMgr.process(PACKAGE_MANAGER_TOOL, cli.package)
+      pkgMgr.process(PACKAGE_MANAGER_TOOL)
     }
   })
   .catch((error) => {

package/lib/helpers/packageRepoUtils.js

@@ -13,7 +13,7 @@ class PackageRepoUtils {
   }
 
   formatPackageForUrl (pkg) {
-    return pkg.replace('/', '%2F')
+    return pkg.replace(/\//g, '%2F')
   }
 
   getPackageInfo (pkg) {

package/lib/marshalls/expiredDomains.marshall.js

@@ -0,0 +1,46 @@
+'use strict'
+
+const BaseMarshall = require('./baseMarshall')
+const dns = require('dns').promises
+
+const MARSHALL_NAME = 'maintainers_expired_emails'
+
+class Marshall extends BaseMarshall {
+  constructor (options) {
+    super(options)
+    this.name = MARSHALL_NAME
+  }
+
+  title () {
+    return 'Detecting expired domains for authors account...'
+  }
+
+  validate (pkg) {
+    return this.packageRepoUtils
+      .getPackageInfo(pkg.packageName)
+      .then((data) => {
+        const lastVersionData =
+          data.versions && data['dist-tags'] && data.versions[data['dist-tags']['latest']]
+
+        let maintainersAccounts = lastVersionData && lastVersionData.maintainers
+
+        let testEmails = []
+        for (const maintainerInfo of maintainersAccounts) {
+          const maintainerEmail = maintainerInfo.email
+          const emailDomain = maintainerEmail.split('@')[1]
+          testEmails.push(dns.resolve(emailDomain))
+        }
+
+        return Promise.all(testEmails)
+      })
+      .catch((error) => {
+        let emailHostname = error.hostname ? error.hostname : '<unknown>'
+        throw new Error(
+          'Unable to resolve domain for maintainer e-mail, could be an expired account: ' +
+            emailHostname
+        )
+      })
+  }
+}
+
+module.exports = Marshall

package/lib/marshalls/index.js

@@ -47,15 +47,15 @@ class Marshalls {
   }
 
   static tasks (options) {
-    return this.warmUpPackagesCache(options)
-      .then(() => this.collectMarshalls())
+    return Marshalls.warmUpPackagesCache(options)
+      .then(() => Marshalls.collectMarshalls())
       .then((marshalls) => {
-        return this.buildMarshallTasks(marshalls, {
+        return Marshalls.buildMarshallTasks(marshalls, {
           packageRepoUtils: options.packageRepoUtils
         })
       })
       .then((tasks) => {
-        return this.runTasks(tasks, options)
+        return Marshalls.runTasks(tasks, options)
       })
   }
 

package/lib/packageManager.js

@@ -5,12 +5,12 @@ const childProcess = require('child_process')
 const DEFAULT_PKGMGR = 'npm'
 
 class packageManager {
-  static process (packageManager) {
-    packageManager = this.validatePackageManager(packageManager)
-    return this.spawnPackageManager(packageManager)
+  static process (packageManagerOption) {
+    const detectedPackageManager = packageManager.validatePackageManager(packageManagerOption)
+    return packageManager.spawnPackageManager(detectedPackageManager)
   }
 
-  static spawnPackageManager (packageManager) {
+  static spawnPackageManager (packageManagerOption) {
     let args = []
 
     args = args.concat(process.argv.slice(2)).filter((item) => {
@@ -24,7 +24,7 @@ class packageManager {
       }
     })
 
-    const child = childProcess.spawn(packageManager, args, {
+    const child = childProcess.spawn(packageManagerOption, args, {
       stdio: 'inherit',
       shell: true
     })
@@ -32,16 +32,16 @@ class packageManager {
     return Promise.resolve(child)
   }
 
-  static validatePackageManager (packageManager) {
-    if (!packageManager) {
-      packageManager = this.getDefaultPackageManager()
+  static validatePackageManager (packageManagerOption) {
+    if (!packageManagerOption) {
+      packageManagerOption = packageManager.getDefaultPackageManager()
     }
 
-    if (typeof packageManager !== 'string') {
+    if (typeof packageManagerOption !== 'string') {
       throw new Error('a packageManager should be specified as a string')
     }
 
-    return packageManager
+    return packageManagerOption
   }
 
   static getDefaultPackageManager () {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "2.2.0",
+  "version": "2.3.1",
   "description": "marshall your npm/yarn package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",
@@ -30,6 +30,10 @@
     "type": "git",
     "url": "git+https://github.com/lirantal/npq.git"
   },
+  "publishConfig": {
+    "provenance": true,
+    "access": "public"
+  },
   "devDependencies": {
     "@babel/core": "^7.7.4",
     "@babel/plugin-transform-runtime": "^7.7.4",
@@ -52,7 +56,7 @@
     "lockfile-lint": "^2.0.1",
     "opn-cli": "^4.0.0",
     "prettier": "^2.8.3",
-    "semantic-release": "^15.0.0",
+    "semantic-release": "21.0.2",
     "standard": "^12.0.0"
   },
   "jest": {
@@ -152,14 +156,14 @@
       "node/no-unsupported-features/node-builtins": [
         "error",
         {
-          "version": ">=10.1.0",
+          "version": ">=10.6.0",
           "ignores": []
         }
       ],
       "node/no-unsupported-features/es-syntax": [
         "error",
         {
-          "version": ">=10.1.0",
+          "version": ">=10.6.0",
           "ignores": []
         }
       ]
@@ -183,17 +187,19 @@
   "dependencies": {
     "chalk": "^2.3.0",
     "glob": "^8.0.3",
-    "inquirer": "^7.3.3",
+    "inquirer": "^8.0.0",
     "listr": "^0.14.0",
     "node-fetch": "^2.6.7",
     "npm-package-arg": "^10.1.0",
     "semver": "^7.3.8",
     "update-notifier": "^5",
-    "validator": "^13.6.0",
+    "validator": "13.7.0",
     "yargs": "^17.6.2"
   },
   "release": {
-    "branch": "master",
+    "branches": [
+      "main"
+    ],
     "analyzeCommits": {
       "preset": "angular",
       "releaseRules": [