npq 2.2.0 → 2.4.0

package/.github/mergify.yml

@@ -0,0 +1,17 @@
+queue_rules:
+  - name: Snyk PRs Queue
+    conditions:
+      - "check-success ~= .*"
+      
+pull_request_rules:
+  - name: Automatic merge Snyk PRs on Status Checks passing
+    conditions:
+      - title~=^\[Snyk\]
+      - head~=^snyk-fix
+      - base=main
+    actions:
+      queue:
+        name: "Snyk PRs Queue"
+      label:
+        add:
+          - "auto-merge"

package/.github/workflows/main.yml

@@ -7,7 +7,7 @@ jobs:
     strategy:
       matrix:
         platform: [ubuntu-latest]
-        node: ['12', '14']
+        node: ['12', '14', '16', '18']
     name: Node ${{ matrix.node }} (${{ matrix.platform }})
     runs-on: ${{ matrix.platform }}
     steps:
@@ -37,13 +37,18 @@ jobs:
   release:
     name: do semantic release
     runs-on: 'ubuntu-latest'
+    permissions:
+      contents: write # to be able to publish a GitHub release
+      issues: write # to be able to comment on released issues
+      pull-requests: write # to be able to comment on released pull requests
+      id-token: write # to enable use of OIDC for npm provenance
     needs: build
-    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     steps:
       - uses: actions/checkout@v2
       - uses: actions/setup-node@v2
         with:
-          node-version: '14'
+          node-version: '18'
       - name: install dependencies
         run: yarn install --frozen-lockfile --ignore-engines --ignore-scripts
       - name: release

package/README.md

@@ -1,13 +1,13 @@
 <p align="center">
 	<br>
-  <img width="200" src="https://github.com/lirantal/npq/raw/master/.github/Logo%20Horizontal.png">
+  <img width="200" src="https://github.com/lirantal/npq/raw/main/.github/Logo%20Horizontal.png">
 	<br>
 	safely* install packages with npm/yarn by auditing them as part of your install process
 </p>
 
 [![npm](https://img.shields.io/npm/v/npq.svg)](https://www.npmjs.com/package/npq)
 [![npm](https://img.shields.io/npm/l/npq.svg)](https://www.npmjs.com/package/npq)
-[![codecov](https://codecov.io/gh/lirantal/npq/branch/master/graph/badge.svg)](https://codecov.io/gh/lirantal/npq)
+[![codecov](https://codecov.io/gh/lirantal/npq/branch/main/graph/badge.svg)](https://codecov.io/gh/lirantal/npq)
 [![Build Status](https://github.com/lirantal/npq/workflows/unit-tests/badge.svg)](https://github.com/lirantal/npq/workflows/unit-tests)
 [![Known Vulnerabilities](https://snyk.io/test/github/lirantal/npq/badge.svg)](https://snyk.io/test/github/lirantal/npq)
 [![Security Responsible Disclosure](https://img.shields.io/badge/Security-Responsible%20Disclosure-yellow.svg)](./SECURITY.md)
@@ -15,7 +15,7 @@
 
 [![npq](https://snyk.io/advisor/npm-package/npq/badge.svg)](https://snyk.io/advisor/npm-package/npq)
 
-![npq-demo-3-final](https://github.com/lirantal/npq/blob/master/.github/npq-demo.gif?raw=true)
+![npq-demo-3-final](https://github.com/lirantal/npq/blob/main/.github/npq-demo.gif?raw=true)
 
 
 Media coverage about npq:
@@ -96,14 +96,15 @@ Note: `npq` by default will offload all commands and their arguments to the `npm
 | readme | Will show a warning if a package has no README or it has been detected as a security placeholder package by npm staff
 | repo | Will show a warning if a package has been found without a valid and working repository URL | Checks the latest version for a repository URL
 | scripts | Will show a warning if a package has a pre/post install script which could potentially be malicious
-| snyk | Will show a warning if a package has been found with vulnerabilities in snyk's database | For snyk to work you need to either have the `snyk` npm package installed with a valid api token, or make the token available in the SNYK_TOKEN environment variable, and npq will use it
+| snyk | Will show a warning if a package has been found with vulnerabilities in Snyk's database | For Snyk to work you need to either have the `snyk` npm package installed with a valid api token, or make the token available in the SNYK_TOKEN environment variable, and npq will use it
 | license | Will show a warning if a package has been found without a license field | Checks the latest version for a license
+| expired domains | Will show a warning if a package has been found with one of its maintainers having an email address that includes an expired domain | Checks a dependency version for a maintainer with an expired domain
 
 ### Disabling Marshalls
 
 To disable a marshall altogether, set an environment variable using with the marshall's shortname.
 
-Example, to disable snyk:
+Example, to disable the Snyk vulnerability marshall:
 
 ```
 MARSHALL_DISABLE_SNYK=1 npq install express
@@ -134,14 +135,14 @@ script:
 * NPQ will audit a package for possible security issues, but it isn't a replacement for npm or yarn. When you choose to continue installing the package, it will offload the installation process to your choice of either npm or yarn.
 2. **How is NPQ different from npm audit?**
 * `npm install` will install a module even if it has vulnerabilities; NPQ will display the issues detected, and prompt the user for confirmation on whether to proceed installing it.
-* NPQ will run synthethic checks, called [marshalls](https://github.com/lirantal/npq#marshalls), on the characteristics of a module, such as whether the module you are going to install has a `pre-install` script which can be potentially harmful for your system and prompt you whether to install it. Whereas `npm audit` will not perform any such checks, and only consults a vulnerability database for known security issues.
-* `npm audit` is closer in functionality to what snyk does, rather than what NPQ does.
-3. **Do I require a snyk API key in order to use NPQ?**
-* It's not required. If NPQ is unable to detect a snyk API key for the user running NPQ, then it will skip the database vulnerabilities check. We do, however, greatly encourage you to use snyk, and connect it with NPQ for broader security.
+* NPQ will run synthetic checks, called [marshalls](https://github.com/lirantal/npq#marshalls), on the characteristics of a module, such as whether the module you are going to install has a `pre-install` script which can be potentially harmful for your system and prompt you whether to install it. Whereas `npm audit` will not perform any such checks, and only consults a vulnerability database for known security issues.
+* `npm audit` is closer in functionality to what Snyk does, rather than what NPQ does.
+3. **Do I require a Snyk API key in order to use NPQ?**
+* It's not required. If NPQ is unable to detect a Snyk API key for the user running NPQ, then it will skip the database vulnerabilities check. We do, however, greatly encourage you to use Snyk, and connect it with NPQ for broader security.
 
 ## Contributing
 
-Please consult the [CONTRIBUTING](https://github.com/lirantal/npq/blob/master/CONTRIBUTING.md) for guidelines on contributing to this project
+Please consult the [CONTRIBUTING](https://github.com/lirantal/npq/blob/main/CONTRIBUTING.md) for guidelines on contributing to this project
 
 ## Author
 Liran Tal <liran.tal@gmail.com>

package/__tests__/__fixtures__/test.marshall.js

@@ -5,16 +5,16 @@ const BaseMarshall = require('../../lib/marshalls/baseMarshall')
 const MARSHALL_NAME = 'test.marshall'
 
 class TestMarshall extends BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title () {
+  title() {
     return 'A test marshall'
   }
 
-  run (ctx, task) {
+  run(ctx, task) {
     const tasks = ctx.pkgs.reduce((prevPkg, currPkg) => {
       return prevPkg.concat(this.mockCheck(currPkg, ctx, task))
     }, [])
@@ -22,7 +22,7 @@ class TestMarshall extends BaseMarshall {
     return Promise.all(tasks)
   }
 
-  mockCheck (pkg, ctx, task) {
+  mockCheck(pkg, ctx, task) {
     return this.validateSomething(pkg)
       .then(() => {
         const data = 'mock data check'
@@ -39,7 +39,7 @@ class TestMarshall extends BaseMarshall {
       })
   }
 
-  validateSomething (pkg) {
+  validateSomething(pkg) {
     if (pkg === 'express' || pkg === 'semver') {
       return Promise.resolve()
     } else {
@@ -47,7 +47,7 @@ class TestMarshall extends BaseMarshall {
     }
   }
 
-  validate (pkg) {
+  validate(pkg) {
     if (pkg === 'express' || pkg === 'semver') {
       return Promise.resolve('validation-result')
     } else {

package/__tests__/marshalls.base.test.js

@@ -27,7 +27,7 @@ test('checkPackage returns validation data if it was a success', async () => {
   expect(result).toEqual('validation-result')
 })
 
-test('checkPackage sets the error property if the validaiton failed', async () => {
+test('checkPackage sets the error property if the validation failed', async () => {
   const testMarshall = new TestMarshall({
     packageRepoUtils: null
   })

package/__tests__/marshalls.expiredDomains.test.js

@@ -0,0 +1,100 @@
+const ExpiredDomainsMarshall = require('../lib/marshalls/expiredDomains.marshall')
+
+const testMarshall = new ExpiredDomainsMarshall({
+  packageRepoUtils: {
+    getPackageInfo: (pkgInfo) => {
+      return new Promise((resolve) => {
+        resolve(pkgInfo)
+      })
+    }
+  }
+})
+
+describe('Expired domains test suites', () => {
+  beforeEach(() => {
+    jest.clearAllMocks()
+    jest.resetAllMocks()
+  })
+
+  test('has the right title', async () => {
+    expect(testMarshall.title()).toEqual('Detecting expired domains for authors account...')
+  })
+
+  test('throws the right error when an email domain cant be verified', async () => {
+    const nonExistentEmailAddress =
+      'liran.tal+test1234@somenonexistentdomainongoogle109dubv98g39ujasdasda.com'
+    const pkgData = {
+      packageName: {
+        'dist-tags': {
+          latest: '1.0.0'
+        },
+        versions: {
+          '1.0.0': {
+            maintainers: [
+              { name: 'lirantal', email: 'liran.tal@gmail.com' },
+              {
+                name: 'lirantal_test_user',
+                email: nonExistentEmailAddress
+              }
+            ]
+          }
+        }
+      }
+    }
+
+    await expect(testMarshall.validate(pkgData)).rejects.toThrow(
+      /Unable to resolve domain for maintainer e-mail, could be an expired account/
+    )
+  })
+
+  test('if email hostname is empty then show an unknown message', async () => {
+    const nonExistentEmailAddress = ''
+    const pkgData = {
+      packageName: {
+        'dist-tags': {
+          latest: '1.0.0'
+        },
+        versions: {
+          '1.0.0': {
+            maintainers: [
+              { name: 'lirantal', email: 'liran.tal@gmail.com' },
+              {
+                name: 'lirantal_test_user',
+                email: nonExistentEmailAddress
+              }
+            ]
+          }
+        }
+      }
+    }
+
+    await expect(testMarshall.validate(pkgData)).rejects.toThrow(
+      /Unable to resolve domain for maintainer e-mail, could be an expired account: <unknown>/
+    )
+  })
+
+  test('does not throw any errors if the domain resolves well', async () => {
+    jest.setTimeout(15000)
+
+    const pkgData = {
+      packageName: {
+        'dist-tags': {
+          latest: '1.0.0'
+        },
+        versions: {
+          '1.0.0': {
+            maintainers: [
+              { name: 'lirantal', email: 'liran.tal@gmail.com' },
+              {
+                name: 'lirantal_test_user',
+                email: 'liran.tal@gmail.com'
+              }
+            ]
+          }
+        }
+      }
+    }
+
+    await expect(testMarshall.validate(pkgData)).resolves.toEqual(expect.anything())
+  })
+})

package/__tests__/marshalls.tasks.test.js

@@ -2,7 +2,7 @@ const path = require('path')
 const marshalls = require('../lib/marshalls')
 
 const PackageRepoUtilsMock = class Fake {
-  getPackageInfo () {
+  getPackageInfo() {
     return Promise.resolve(true)
   }
 }

package/__tests__/packageManager.test.js

@@ -59,7 +59,7 @@ test('package manager spawns successfully when provided array of packages to han
   childProcess.spawn.mockReset()
 })
 
-test('package manager spawns successfully and ignore npqs own internal commands when spawning package manager', async () => {
+test("package manager spawns successfully and ignore npq's own internal commands when spawning package manager", async () => {
   process.argv = [
     'node',
     'script name',

package/bin/npq-hero.js

@@ -43,7 +43,7 @@ marshall
   })
   .then((status) => {
     if (status && status.hasOwnProperty('install') && status.install === true) {
-      pkgMgr.process(PACKAGE_MANAGER_TOOL, cli.package)
+      pkgMgr.process(PACKAGE_MANAGER_TOOL)
     }
   })
   .catch((error) => {

package/lib/cliCommons.js

@@ -1,6 +1,6 @@
 const npa = require('npm-package-arg')
 class cliCommons {
-  static getInstallCommand () {
+  static getInstallCommand() {
     return {
       command: 'install [package...]',
       aliases: [
@@ -31,7 +31,7 @@ class cliCommons {
     }
   }
 
-  static getOptions () {
+  static getOptions() {
     return {
       P: {
         alias: ['save-prod', 'peer'],

package/lib/helpers/packageRepoUtils.js

@@ -6,17 +6,17 @@ const NPM_REGISTRY = 'http://registry.npmjs.org'
 const NPM_REGISTRY_API = 'https://api.npmjs.org'
 
 class PackageRepoUtils {
-  constructor (options = {}) {
+  constructor(options = {}) {
     this.registryUrl = options.registryUrl ? options.registryUrl : NPM_REGISTRY
     this.registryApiUrl = options.registryApiUrl ? options.registryApiUrl : NPM_REGISTRY_API
     this.pkgInfoCache = {}
   }
 
-  formatPackageForUrl (pkg) {
-    return pkg.replace('/', '%2F')
+  formatPackageForUrl(pkg) {
+    return pkg.replace(/\//g, '%2F')
   }
 
-  getPackageInfo (pkg) {
+  getPackageInfo(pkg) {
     if (this.pkgInfoCache[pkg]) {
       return Promise.resolve(this.pkgInfoCache[pkg])
     } else {
@@ -29,27 +29,27 @@ class PackageRepoUtils {
     }
   }
 
-  getLatestVersion (pkg) {
+  getLatestVersion(pkg) {
     return this.getPackageInfo(pkg).then((data) => {
       return data['dist-tags'] && data['dist-tags']['latest'] ? data['dist-tags']['latest'] : null
     })
   }
 
-  getDownloadInfo (pkg) {
+  getDownloadInfo(pkg) {
     return fetch(`${this.registryApiUrl}/downloads/point/last-month/${pkg}`)
       .then((response) => response.json())
       .then(({ downloads }) => downloads)
   }
 
-  getReadmeInfo (pkg) {
+  getReadmeInfo(pkg) {
     return this.getPackageInfo(pkg).then(({ readme }) => readme)
   }
 
-  getLicenseInfo (pkg) {
+  getLicenseInfo(pkg) {
     return this.getPackageInfo(pkg).then(({ license }) => license)
   }
 
-  parsePackageVersion (version) {
+  parsePackageVersion(version) {
     return semver.coerce(version)
   }
 }

package/lib/marshall.js

@@ -12,12 +12,12 @@ const MESSAGE_TYPE = {
 }
 
 class Marshall {
-  constructor (options = {}) {
+  constructor(options = {}) {
     this.pkgs = options ? options.pkgs : null
     this.packageRepoUtils = new PackageRepoUtils()
   }
 
-  process () {
+  process() {
     // nothing to do? move on
     if (!this.pkgs) {
       return Promise.resolve()
@@ -37,7 +37,7 @@ class Marshall {
     })
   }
 
-  createPackageVersionMaps (packages) {
+  createPackageVersionMaps(packages) {
     const packageVersionMapping = packages.reduce((prev, curr) => {
       const versionSymbolPosition = curr.lastIndexOf('@')
       const versionPosition =
@@ -57,7 +57,7 @@ class Marshall {
     return packageVersionMapping
   }
 
-  report (marshalls) {
+  report(marshalls) {
     const messages = this.collectPackageMessages(marshalls)
 
     if (!messages) {
@@ -81,7 +81,7 @@ class Marshall {
     return { error: true, data: messages }
   }
 
-  collectPackageMessages (marshalls) {
+  collectPackageMessages(marshalls) {
     const allPackageMessages = {}
     for (const key in marshalls) {
       this.prepareMessages(allPackageMessages, marshalls[key].errors)
@@ -91,7 +91,7 @@ class Marshall {
     return allPackageMessages
   }
 
-  prepareMessages (allPackageMessages, messages, isWarning) {
+  prepareMessages(allPackageMessages, messages, isWarning) {
     if (Array.isArray(messages) && messages.length > 0) {
       messages.forEach((msg) => {
         this.appendPackageMessage(allPackageMessages, msg.pkg, {
@@ -102,7 +102,7 @@ class Marshall {
     }
   }
 
-  appendPackageMessage (packages, packageName, packageMessage) {
+  appendPackageMessage(packages, packageName, packageMessage) {
     packages[packageName]
       ? packages[packageName].push(packageMessage)
       : (packages[packageName] = [packageMessage])

package/lib/marshalls/age.marshall.js

@@ -6,16 +6,16 @@ const MARSHALL_NAME = 'age'
 const PACKAGE_AGE_THRESHOLD = 22 // specified in days
 
 class Marshall extends BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title () {
+  title() {
     return 'Checking package maturity'
   }
 
-  validate (pkg) {
+  validate(pkg) {
     return this.packageRepoUtils.getPackageInfo(pkg.packageName).then((data) => {
       if (data && data.time && data.time.created) {
         const pkgCreatedDate = data.time.created

package/lib/marshalls/author.marshall.js

@@ -7,16 +7,16 @@ const Warning = require('../helpers/warning')
 const MARSHALL_NAME = 'author'
 
 class Marshall extends BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title () {
+  title() {
     return 'Identifying package author...'
   }
 
-  validate (pkg) {
+  validate(pkg) {
     return this.packageRepoUtils.getPackageInfo(pkg.packageName).then((data) => {
       const lastVersionData =
         data.versions && data['dist-tags'] && data.versions[data['dist-tags']['latest']]

package/lib/marshalls/baseMarshall.js

@@ -3,11 +3,11 @@
 const Warning = require('../helpers/warning')
 
 class BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     this.packageRepoUtils = options.packageRepoUtils
   }
 
-  init (ctx, task) {
+  init(ctx, task) {
     this.ctx = ctx
     this.task = task
 
@@ -19,7 +19,7 @@ class BaseMarshall {
     }
   }
 
-  run (ctx, task) {
+  run(ctx, task) {
     const tasks = ctx.pkgs.reduce((prevPkg, currPkg) => {
       return prevPkg.concat(this.checkPackage(currPkg, ctx, task))
     }, [])
@@ -27,7 +27,7 @@ class BaseMarshall {
     return Promise.all(tasks)
   }
 
-  checkPackage (pkg, ctx, task) {
+  checkPackage(pkg, ctx, task) {
     return this.validate(pkg)
       .then((data) => {
         task.output = `querying ${pkg.packageString}...`
@@ -37,30 +37,23 @@ class BaseMarshall {
         return data
       })
       .catch((err) => {
-        if (err instanceof Warning) {
-          this.setMessage(
-            {
-              pkg: pkg.packageString,
-              message: err.message
-            },
-            true
-          )
-        } else {
-          this.setMessage({
+        this.setMessage(
+          {
             pkg: pkg.packageString,
             message: err.message
-          })
-        }
+          },
+          Boolean(err instanceof Warning)
+        )
       })
   }
 
-  isEnabled () {
+  isEnabled() {
     const isMarshallSilent = process.env[`MARSHALL_DISABLE_${this.name.toUpperCase()}`] || false
 
     return !isMarshallSilent
   }
 
-  setMessage (msg, isWarning) {
+  setMessage(msg, isWarning) {
     const messages = isWarning
       ? this.ctx.marshalls[this.name].warnings
       : this.ctx.marshalls[this.name].errors
@@ -71,7 +64,7 @@ class BaseMarshall {
     })
   }
 
-  handleMessages () {
+  handleMessages() {
     const errors = this.ctx.marshalls[this.name].errors
     const warnings = this.ctx.marshalls[this.name].warnings
     if ((errors && errors.length) || (warnings && warnings.length)) {

package/lib/marshalls/downloads.marshall.js

@@ -6,16 +6,16 @@ const MARSHALL_NAME = 'downloads'
 const DOWNLOAD_COUNT_THRESHOLD = 20 // threshold per month
 
 class Marshall extends BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title () {
+  title() {
     return 'Checking package download popularity'
   }
 
-  validate (pkg) {
+  validate(pkg) {
     return this.packageRepoUtils.getDownloadInfo(pkg.packageName).then((downloadCount) => {
       if (downloadCount < DOWNLOAD_COUNT_THRESHOLD) {
         throw new Error(

package/lib/marshalls/expiredDomains.marshall.js

@@ -0,0 +1,46 @@
+'use strict'
+
+const BaseMarshall = require('./baseMarshall')
+const dns = require('dns').promises
+
+const MARSHALL_NAME = 'maintainers_expired_emails'
+
+class Marshall extends BaseMarshall {
+  constructor(options) {
+    super(options)
+    this.name = MARSHALL_NAME
+  }
+
+  title() {
+    return 'Detecting expired domains for authors account...'
+  }
+
+  validate(pkg) {
+    return this.packageRepoUtils
+      .getPackageInfo(pkg.packageName)
+      .then((data) => {
+        const lastVersionData =
+          data.versions && data['dist-tags'] && data.versions[data['dist-tags']['latest']]
+
+        let maintainersAccounts = lastVersionData && lastVersionData.maintainers
+
+        let testEmails = []
+        for (const maintainerInfo of maintainersAccounts) {
+          const maintainerEmail = maintainerInfo.email
+          const emailDomain = maintainerEmail.split('@')[1]
+          testEmails.push(dns.resolve(emailDomain))
+        }
+
+        return Promise.all(testEmails)
+      })
+      .catch((error) => {
+        let emailHostname = error.hostname ? error.hostname : '<unknown>'
+        throw new Error(
+          'Unable to resolve domain for maintainer e-mail, could be an expired account: ' +
+            emailHostname
+        )
+      })
+  }
+}
+
+module.exports = Marshall

package/lib/marshalls/index.js

@@ -4,7 +4,7 @@ const Listr = require('listr')
 const glob = require('glob')
 
 class Marshalls {
-  static collectMarshalls () {
+  static collectMarshalls() {
     return new Promise((resolve, reject) => {
       glob(
         this.GLOB_MARSHALLS,
@@ -23,7 +23,7 @@ class Marshalls {
     })
   }
 
-  static buildMarshallTasks (marshalls, config) {
+  static buildMarshallTasks(marshalls, config) {
     if (!marshalls || !Array.isArray(marshalls) || marshalls.length === 0) {
       return Promise.reject(new Error('unable to collect marshalls, or no marshalls found'))
     }
@@ -46,20 +46,20 @@ class Marshalls {
     return new Listr(marshallTasks, { exitOnError: false, concurrent: true })
   }
 
-  static tasks (options) {
-    return this.warmUpPackagesCache(options)
-      .then(() => this.collectMarshalls())
+  static tasks(options) {
+    return Marshalls.warmUpPackagesCache(options)
+      .then(() => Marshalls.collectMarshalls())
       .then((marshalls) => {
-        return this.buildMarshallTasks(marshalls, {
+        return Marshalls.buildMarshallTasks(marshalls, {
           packageRepoUtils: options.packageRepoUtils
         })
       })
       .then((tasks) => {
-        return this.runTasks(tasks, options)
+        return Marshalls.runTasks(tasks, options)
       })
   }
 
-  static warmUpPackagesCache (options) {
+  static warmUpPackagesCache(options) {
     const fetchPackagesInfoPromises = []
     options.pkgs.forEach((packageMeta) => {
       fetchPackagesInfoPromises.push(
@@ -70,7 +70,7 @@ class Marshalls {
     return Promise.all(fetchPackagesInfoPromises)
   }
 
-  static runTasks (tasks, options) {
+  static runTasks(tasks, options) {
     return tasks.run({
       pkgs: options.pkgs,
       marshalls: {}

package/lib/marshalls/license.marshall.js

@@ -5,16 +5,16 @@ const BaseMarshall = require('./baseMarshall')
 const MARSHALL_NAME = 'license'
 
 class Marshall extends BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title () {
+  title() {
     return 'Checking availability of a LICENSE'
   }
 
-  validate (pkg) {
+  validate(pkg) {
     return this.packageRepoUtils.getLicenseInfo(pkg.packageName).then((licenseContents) => {
       if (!licenseContents || licenseContents === 'ERROR: No LICENSE data found!') {
         throw new Error('package has no LICENSE file available')

package/lib/marshalls/readme.marshall.js

@@ -5,16 +5,16 @@ const BaseMarshall = require('./baseMarshall')
 const MARSHALL_NAME = 'readme'
 
 class Marshall extends BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title () {
+  title() {
     return 'Checking availability of a README'
   }
 
-  validate (pkg) {
+  validate(pkg) {
     return this.packageRepoUtils.getReadmeInfo(pkg.packageName).then((readmeContents) => {
       if (!readmeContents || readmeContents === 'ERROR: No README data found!') {
         throw new Error('package has no README file available')

package/lib/marshalls/repo.marshall.js

@@ -6,16 +6,16 @@ const URL = require('url').URL
 const MARSHALL_NAME = 'repo'
 
 class Marshall extends BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title () {
+  title() {
     return 'Identifying package repository...'
   }
 
-  validate (pkg) {
+  validate(pkg) {
     return this.packageRepoUtils.getPackageInfo(pkg.packageName).then((data) => {
       const lastVersionData =
         (data.versions &&

package/lib/marshalls/scripts.marshall.js

@@ -5,16 +5,16 @@ const BaseMarshall = require('./baseMarshall')
 const MARSHALL_NAME = 'scripts'
 
 class Marshall extends BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title () {
+  title() {
     return 'Checking package for pre/post install scripts'
   }
 
-  validate (pkg) {
+  validate(pkg) {
     return this.packageRepoUtils.getPackageInfo(pkg.packageName).then((data) => {
       const packageVersion =
         pkg.packageVersion === 'latest'

package/lib/marshalls/signatures.marshall.js

@@ -0,0 +1,62 @@
+'use strict'
+
+const BaseMarshall = require('./baseMarshall')
+const pacote = require('pacote')
+
+const MARSHALL_NAME = 'signatures'
+
+class Marshall extends BaseMarshall {
+  constructor(options) {
+    super(options)
+    this.name = MARSHALL_NAME
+  }
+
+  title() {
+    return 'Verifying registry signatures for package'
+  }
+
+  validate(pkg) {
+    // @TODO currently we're hardcoding the official npm registry
+    // this should however allow for local proxies and other registries
+    return this.fetchRegistryKeys()
+      .then((keys) => {
+        return pacote.manifest(`${pkg.packageName}@${pkg.packageVersion}`, {
+          verifySignatures: true,
+          registry: 'https://registry.npmjs.org',
+
+          [`//registry.npmjs.org/:_keys`]: keys
+        })
+      })
+      .then((metadata) => {
+        return metadata
+      })
+  }
+
+  fetchRegistryKeys() {
+    const registryHost = 'https://registry.npmjs.org'
+    const registryKeysEndpoint = '/-/npm/v1/keys'
+
+    const registryKeysUrl = `${registryHost}${registryKeysEndpoint}`
+    // eslint-disable-next-line no-undef
+    return fetch(registryKeysUrl)
+      .then((response) => {
+        return response.json()
+      })
+      .then((response) => {
+        const registryKeys = response.keys
+
+        return registryKeys.map((key) => ({
+          ...key,
+          pemkey: `-----BEGIN PUBLIC KEY-----\n${key.key}\n-----END PUBLIC KEY-----`
+        }))
+      })
+      .then((keys) => {
+        return keys
+      })
+      .catch((error) => {
+        throw new Error(`error fetching registry keys: ${error.message}`)
+      })
+  }
+}
+
+module.exports = Marshall

package/lib/marshalls/snyk.marshall.js

@@ -14,18 +14,18 @@ const SNYK_API_TOKEN = process.env.SNYK_TOKEN
 const SNYK_CONFIG_FILE = '.config/configstore/snyk.json'
 
 class Marshall extends BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
 
     this.snykApiToken = this.getSnykToken()
   }
 
-  title () {
+  title() {
     return 'Checking for known vulnerabilities'
   }
 
-  run (ctx, task) {
+  run(ctx, task) {
     const tasks = ctx.pkgs.reduce((prevPkg, currPkg) => {
       return prevPkg.concat(this.checkPackage(currPkg, ctx, task))
     }, [])
@@ -33,7 +33,7 @@ class Marshall extends BaseMarshall {
     return Promise.all(tasks)
   }
 
-  validate (pkg) {
+  validate(pkg) {
     return Promise.resolve()
       .then(() => {
         if (!pkg.packageVersion || pkg.packageVersion === 'latest') {
@@ -60,7 +60,7 @@ class Marshall extends BaseMarshall {
       })
   }
 
-  getSnykVulnInfoUnauthenticated ({ packageName, packageVersion }) {
+  getSnykVulnInfoUnauthenticated({ packageName, packageVersion }) {
     const url = encodeURI(`${SNYK_TEST_URL}/${packageName}/${packageVersion}?type=json`)
 
     return fetch(url)
@@ -77,7 +77,7 @@ class Marshall extends BaseMarshall {
       .catch(() => false)
   }
 
-  getSnykVulnInfo ({ packageName, packageVersion } = {}) {
+  getSnykVulnInfo({ packageName, packageVersion } = {}) {
     if (!this.snykApiToken) {
       return this.getSnykVulnInfoUnauthenticated({ packageName, packageVersion })
     }
@@ -102,7 +102,7 @@ class Marshall extends BaseMarshall {
       .catch(() => false)
   }
 
-  getSnykToken () {
+  getSnykToken() {
     if (SNYK_API_TOKEN) {
       return SNYK_API_TOKEN
     }

package/lib/packageManager.js

@@ -5,12 +5,12 @@ const childProcess = require('child_process')
 const DEFAULT_PKGMGR = 'npm'
 
 class packageManager {
-  static process (packageManager) {
-    packageManager = this.validatePackageManager(packageManager)
-    return this.spawnPackageManager(packageManager)
+  static process(packageManagerOption) {
+    const detectedPackageManager = packageManager.validatePackageManager(packageManagerOption)
+    return packageManager.spawnPackageManager(detectedPackageManager)
   }
 
-  static spawnPackageManager (packageManager) {
+  static spawnPackageManager(packageManagerOption) {
     let args = []
 
     args = args.concat(process.argv.slice(2)).filter((item) => {
@@ -24,7 +24,7 @@ class packageManager {
       }
     })
 
-    const child = childProcess.spawn(packageManager, args, {
+    const child = childProcess.spawn(packageManagerOption, args, {
       stdio: 'inherit',
       shell: true
     })
@@ -32,19 +32,19 @@ class packageManager {
     return Promise.resolve(child)
   }
 
-  static validatePackageManager (packageManager) {
-    if (!packageManager) {
-      packageManager = this.getDefaultPackageManager()
+  static validatePackageManager(packageManagerOption) {
+    if (!packageManagerOption) {
+      packageManagerOption = packageManager.getDefaultPackageManager()
     }
 
-    if (typeof packageManager !== 'string') {
+    if (typeof packageManagerOption !== 'string') {
       throw new Error('a packageManager should be specified as a string')
     }
 
-    return packageManager
+    return packageManagerOption
   }
 
-  static getDefaultPackageManager () {
+  static getDefaultPackageManager() {
     return DEFAULT_PKGMGR
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "2.2.0",
+  "version": "2.4.0",
   "description": "marshall your npm/yarn package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",
@@ -30,6 +30,10 @@
     "type": "git",
     "url": "git+https://github.com/lirantal/npq.git"
   },
+  "publishConfig": {
+    "provenance": true,
+    "access": "public"
+  },
   "devDependencies": {
     "@babel/core": "^7.7.4",
     "@babel/plugin-transform-runtime": "^7.7.4",
@@ -52,7 +56,7 @@
     "lockfile-lint": "^2.0.1",
     "opn-cli": "^4.0.0",
     "prettier": "^2.8.3",
-    "semantic-release": "^15.0.0",
+    "semantic-release": "21.0.2",
     "standard": "^12.0.0"
   },
   "jest": {
@@ -152,14 +156,14 @@
       "node/no-unsupported-features/node-builtins": [
         "error",
         {
-          "version": ">=10.1.0",
+          "version": ">=10.6.0",
           "ignores": []
         }
       ],
       "node/no-unsupported-features/es-syntax": [
         "error",
         {
-          "version": ">=10.1.0",
+          "version": ">=10.6.0",
           "ignores": []
         }
       ]
@@ -183,17 +187,20 @@
   "dependencies": {
     "chalk": "^2.3.0",
     "glob": "^8.0.3",
-    "inquirer": "^7.3.3",
+    "inquirer": "^8.0.0",
     "listr": "^0.14.0",
     "node-fetch": "^2.6.7",
     "npm-package-arg": "^10.1.0",
+    "pacote": "^17.0.4",
     "semver": "^7.3.8",
     "update-notifier": "^5",
-    "validator": "^13.6.0",
+    "validator": "13.7.0",
     "yargs": "^17.6.2"
   },
   "release": {
-    "branch": "master",
+    "branches": [
+      "main"
+    ],
     "analyzeCommits": {
       "preset": "angular",
       "releaseRules": [