npq 2.4.0 → 2.4.2

package/.github/workflows/main.yml

@@ -7,7 +7,7 @@ jobs:
     strategy:
       matrix:
         platform: [ubuntu-latest]
-        node: ['12', '14', '16', '18']
+        node: ['18', '20']
     name: Node ${{ matrix.node }} (${{ matrix.platform }})
     runs-on: ${{ matrix.platform }}
     steps:
@@ -16,13 +16,13 @@ jobs:
         with:
           node-version: ${{ matrix.node }}
       - name: install dependencies
-        run: yarn install --frozen-lockfile --ignore-engines --ignore-scripts
+        run: npm ci --ignore-engines --ignore-scripts
       - name: lint code
-        run: yarn run lint
+        run: npm run lint
         env:
           CI: true
       - name: run tests
-        run: yarn run test
+        run: npm run test
         env:
           CI: true
       - name: coverage
@@ -50,9 +50,9 @@ jobs:
         with:
           node-version: '18'
       - name: install dependencies
-        run: yarn install --frozen-lockfile --ignore-engines --ignore-scripts
+        run: npm ci --ignore-engines --ignore-scripts
       - name: release
-        run: yarn run semantic-release
+        run: npm run semantic-release
         env:
           GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
           NPM_TOKEN: ${{secrets.NPM_TOKEN}}

package/README.md

@@ -99,6 +99,7 @@ Note: `npq` by default will offload all commands and their arguments to the `npm
 | snyk | Will show a warning if a package has been found with vulnerabilities in Snyk's database | For Snyk to work you need to either have the `snyk` npm package installed with a valid api token, or make the token available in the SNYK_TOKEN environment variable, and npq will use it
 | license | Will show a warning if a package has been found without a license field | Checks the latest version for a license
 | expired domains | Will show a warning if a package has been found with one of its maintainers having an email address that includes an expired domain | Checks a dependency version for a maintainer with an expired domain
+| signatures | Will compare the package's signature as it shows on the registry's pakument with the keys published on the npmjs.com registry 
 
 ### Disabling Marshalls
 

package/__tests__/__fixtures__/test.marshall.js

@@ -5,16 +5,16 @@ const BaseMarshall = require('../../lib/marshalls/baseMarshall')
 const MARSHALL_NAME = 'test.marshall'
 
 class TestMarshall extends BaseMarshall {
-  constructor(options) {
+  constructor (options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title() {
+  title () {
     return 'A test marshall'
   }
 
-  run(ctx, task) {
+  run (ctx, task) {
     const tasks = ctx.pkgs.reduce((prevPkg, currPkg) => {
       return prevPkg.concat(this.mockCheck(currPkg, ctx, task))
     }, [])
@@ -22,7 +22,7 @@ class TestMarshall extends BaseMarshall {
     return Promise.all(tasks)
   }
 
-  mockCheck(pkg, ctx, task) {
+  mockCheck (pkg, ctx, task) {
     return this.validateSomething(pkg)
       .then(() => {
         const data = 'mock data check'
@@ -39,7 +39,7 @@ class TestMarshall extends BaseMarshall {
       })
   }
 
-  validateSomething(pkg) {
+  validateSomething (pkg) {
     if (pkg === 'express' || pkg === 'semver') {
       return Promise.resolve()
     } else {
@@ -47,7 +47,7 @@ class TestMarshall extends BaseMarshall {
     }
   }
 
-  validate(pkg) {
+  validate (pkg) {
     if (pkg === 'express' || pkg === 'semver') {
       return Promise.resolve('validation-result')
     } else {

package/__tests__/marshalls.signatures.test.js

@@ -0,0 +1,136 @@
+jest.mock('pacote', () => {
+  return {
+    // manifest method should be a promise that resolves to a value:
+    manifest: jest.fn().mockResolvedValue({
+      name: 'packageName',
+      version: '1.0.0'
+      // Add other relevant properties
+    })
+  }
+})
+
+const SignaturesMarshall = require('../lib/marshalls/signatures.marshall')
+const pacote = require('pacote')
+
+describe('Signature test suites', () => {
+  beforeEach(() => {
+    jest.clearAllMocks()
+    jest.resetAllMocks()
+  })
+
+  test('has the right title', async () => {
+    const testMarshall = new SignaturesMarshall({
+      packageRepoUtils: {
+        getPackageInfo: (pkgInfo) => {
+          return new Promise((resolve) => {
+            resolve(pkgInfo)
+          })
+        }
+      }
+    })
+
+    expect(testMarshall.title()).toEqual('Verifying registry signatures for package')
+  })
+
+  test('should successfully validate a package with correct signature', async () => {
+    // Mock the response from fetch
+    const mockResponse = {
+      json: jest.fn().mockResolvedValue({
+        keys: [
+          {
+            key: 'publicKey1'
+          },
+          {
+            key: 'publicKey2'
+          }
+        ]
+      })
+    }
+    global.fetch = jest.fn().mockResolvedValue(mockResponse)
+
+    const testMarshall = new SignaturesMarshall({
+      packageRepoUtils: {
+        getPackageInfo: (pkgInfo) => {
+          return new Promise((resolve) => {
+            resolve(pkgInfo)
+          })
+        }
+      }
+    })
+
+    // Call the validate method with a package object
+    const pkg = {
+      packageName: 'packageName',
+      packageVersion: '1.0.0'
+    }
+
+    // We assert that the validate method didn't throw an error,
+    // because the keys match the signature
+    await testMarshall.validate(pkg)
+
+    // Assert that the fetch method is called with the correct URL
+    // eslint-disable-next-line no-undef
+    expect(fetch).toHaveBeenCalledWith('https://registry.npmjs.org/-/npm/v1/keys')
+
+    // Assert that the pacote.manifest method is called with the correct arguments
+    expect(pacote.manifest).toHaveBeenCalledWith('packageName@1.0.0', {
+      verifySignatures: true,
+      registry: 'https://registry.npmjs.org',
+      '//registry.npmjs.org/:_keys': [
+        {
+          key: 'publicKey1',
+          pemkey: '-----BEGIN PUBLIC KEY-----\npublicKey1\n-----END PUBLIC KEY-----'
+        },
+        {
+          key: 'publicKey2',
+          pemkey: '-----BEGIN PUBLIC KEY-----\npublicKey2\n-----END PUBLIC KEY-----'
+        }
+      ]
+    })
+  })
+
+  test('should throw an error if keys dont match and manifest() throws an error', async () => {
+    // Mock the response from fetch
+    const mockResponse = {
+      json: jest.fn().mockResolvedValue({
+        keys: [
+          {
+            key: 'publicKey1'
+          },
+          {
+            key: 'publicKey2'
+          }
+        ]
+      })
+    }
+    global.fetch = jest.fn().mockResolvedValue(mockResponse)
+
+    // the manifest() method should throw an error
+    // in this jest mock to simulate a problem:
+    pacote.manifest = jest.fn().mockRejectedValue(new Error('mocked manifest error'))
+
+    const testMarshall = new SignaturesMarshall({
+      packageRepoUtils: {
+        getPackageInfo: (pkgInfo) => {
+          return new Promise((resolve) => {
+            resolve(pkgInfo)
+          })
+        }
+      }
+    })
+
+    // Call the validate method with a package object
+    const pkg = {
+      packageName: 'packageName',
+      packageVersion: '1.0.0'
+    }
+
+    // We assert that the validate method didn't throw an error,
+    // because the keys match the signature
+    await expect(testMarshall.validate(pkg)).rejects.toThrow('mocked manifest error')
+
+    // Assert that the fetch method is called with the correct URL
+    // eslint-disable-next-line no-undef
+    expect(fetch).toHaveBeenCalledWith('https://registry.npmjs.org/-/npm/v1/keys')
+  })
+})

package/__tests__/marshalls.tasks.test.js

@@ -2,7 +2,7 @@ const path = require('path')
 const marshalls = require('../lib/marshalls')
 
 const PackageRepoUtilsMock = class Fake {
-  getPackageInfo() {
+  getPackageInfo () {
     return Promise.resolve(true)
   }
 }

package/lib/cliCommons.js

@@ -1,6 +1,6 @@
 const npa = require('npm-package-arg')
 class cliCommons {
-  static getInstallCommand() {
+  static getInstallCommand () {
     return {
       command: 'install [package...]',
       aliases: [
@@ -31,7 +31,7 @@ class cliCommons {
     }
   }
 
-  static getOptions() {
+  static getOptions () {
     return {
       P: {
         alias: ['save-prod', 'peer'],

package/lib/helpers/packageRepoUtils.js

@@ -6,17 +6,17 @@ const NPM_REGISTRY = 'http://registry.npmjs.org'
 const NPM_REGISTRY_API = 'https://api.npmjs.org'
 
 class PackageRepoUtils {
-  constructor(options = {}) {
+  constructor (options = {}) {
     this.registryUrl = options.registryUrl ? options.registryUrl : NPM_REGISTRY
     this.registryApiUrl = options.registryApiUrl ? options.registryApiUrl : NPM_REGISTRY_API
     this.pkgInfoCache = {}
   }
 
-  formatPackageForUrl(pkg) {
+  formatPackageForUrl (pkg) {
     return pkg.replace(/\//g, '%2F')
   }
 
-  getPackageInfo(pkg) {
+  getPackageInfo (pkg) {
     if (this.pkgInfoCache[pkg]) {
       return Promise.resolve(this.pkgInfoCache[pkg])
     } else {
@@ -29,27 +29,27 @@ class PackageRepoUtils {
     }
   }
 
-  getLatestVersion(pkg) {
+  getLatestVersion (pkg) {
     return this.getPackageInfo(pkg).then((data) => {
       return data['dist-tags'] && data['dist-tags']['latest'] ? data['dist-tags']['latest'] : null
     })
   }
 
-  getDownloadInfo(pkg) {
+  getDownloadInfo (pkg) {
     return fetch(`${this.registryApiUrl}/downloads/point/last-month/${pkg}`)
       .then((response) => response.json())
       .then(({ downloads }) => downloads)
   }
 
-  getReadmeInfo(pkg) {
+  getReadmeInfo (pkg) {
     return this.getPackageInfo(pkg).then(({ readme }) => readme)
   }
 
-  getLicenseInfo(pkg) {
+  getLicenseInfo (pkg) {
     return this.getPackageInfo(pkg).then(({ license }) => license)
   }
 
-  parsePackageVersion(version) {
+  parsePackageVersion (version) {
     return semver.coerce(version)
   }
 }

package/lib/marshall.js

@@ -12,12 +12,12 @@ const MESSAGE_TYPE = {
 }
 
 class Marshall {
-  constructor(options = {}) {
+  constructor (options = {}) {
     this.pkgs = options ? options.pkgs : null
     this.packageRepoUtils = new PackageRepoUtils()
   }
 
-  process() {
+  process () {
     // nothing to do? move on
     if (!this.pkgs) {
       return Promise.resolve()
@@ -37,7 +37,7 @@ class Marshall {
     })
   }
 
-  createPackageVersionMaps(packages) {
+  createPackageVersionMaps (packages) {
     const packageVersionMapping = packages.reduce((prev, curr) => {
       const versionSymbolPosition = curr.lastIndexOf('@')
       const versionPosition =
@@ -57,7 +57,7 @@ class Marshall {
     return packageVersionMapping
   }
 
-  report(marshalls) {
+  report (marshalls) {
     const messages = this.collectPackageMessages(marshalls)
 
     if (!messages) {
@@ -81,7 +81,7 @@ class Marshall {
     return { error: true, data: messages }
   }
 
-  collectPackageMessages(marshalls) {
+  collectPackageMessages (marshalls) {
     const allPackageMessages = {}
     for (const key in marshalls) {
       this.prepareMessages(allPackageMessages, marshalls[key].errors)
@@ -91,7 +91,7 @@ class Marshall {
     return allPackageMessages
   }
 
-  prepareMessages(allPackageMessages, messages, isWarning) {
+  prepareMessages (allPackageMessages, messages, isWarning) {
     if (Array.isArray(messages) && messages.length > 0) {
       messages.forEach((msg) => {
         this.appendPackageMessage(allPackageMessages, msg.pkg, {
@@ -102,7 +102,7 @@ class Marshall {
     }
   }
 
-  appendPackageMessage(packages, packageName, packageMessage) {
+  appendPackageMessage (packages, packageName, packageMessage) {
     packages[packageName]
       ? packages[packageName].push(packageMessage)
       : (packages[packageName] = [packageMessage])

package/lib/marshalls/age.marshall.js

@@ -6,16 +6,16 @@ const MARSHALL_NAME = 'age'
 const PACKAGE_AGE_THRESHOLD = 22 // specified in days
 
 class Marshall extends BaseMarshall {
-  constructor(options) {
+  constructor (options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title() {
+  title () {
     return 'Checking package maturity'
   }
 
-  validate(pkg) {
+  validate (pkg) {
     return this.packageRepoUtils.getPackageInfo(pkg.packageName).then((data) => {
       if (data && data.time && data.time.created) {
         const pkgCreatedDate = data.time.created

package/lib/marshalls/author.marshall.js

@@ -7,16 +7,16 @@ const Warning = require('../helpers/warning')
 const MARSHALL_NAME = 'author'
 
 class Marshall extends BaseMarshall {
-  constructor(options) {
+  constructor (options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title() {
+  title () {
     return 'Identifying package author...'
   }
 
-  validate(pkg) {
+  validate (pkg) {
     return this.packageRepoUtils.getPackageInfo(pkg.packageName).then((data) => {
       const lastVersionData =
         data.versions && data['dist-tags'] && data.versions[data['dist-tags']['latest']]

package/lib/marshalls/baseMarshall.js

@@ -3,11 +3,11 @@
 const Warning = require('../helpers/warning')
 
 class BaseMarshall {
-  constructor(options) {
+  constructor (options) {
     this.packageRepoUtils = options.packageRepoUtils
   }
 
-  init(ctx, task) {
+  init (ctx, task) {
     this.ctx = ctx
     this.task = task
 
@@ -19,7 +19,7 @@ class BaseMarshall {
     }
   }
 
-  run(ctx, task) {
+  run (ctx, task) {
     const tasks = ctx.pkgs.reduce((prevPkg, currPkg) => {
       return prevPkg.concat(this.checkPackage(currPkg, ctx, task))
     }, [])
@@ -27,7 +27,7 @@ class BaseMarshall {
     return Promise.all(tasks)
   }
 
-  checkPackage(pkg, ctx, task) {
+  checkPackage (pkg, ctx, task) {
     return this.validate(pkg)
       .then((data) => {
         task.output = `querying ${pkg.packageString}...`
@@ -47,13 +47,13 @@ class BaseMarshall {
       })
   }
 
-  isEnabled() {
+  isEnabled () {
     const isMarshallSilent = process.env[`MARSHALL_DISABLE_${this.name.toUpperCase()}`] || false
 
     return !isMarshallSilent
   }
 
-  setMessage(msg, isWarning) {
+  setMessage (msg, isWarning) {
     const messages = isWarning
       ? this.ctx.marshalls[this.name].warnings
       : this.ctx.marshalls[this.name].errors
@@ -64,7 +64,7 @@ class BaseMarshall {
     })
   }
 
-  handleMessages() {
+  handleMessages () {
     const errors = this.ctx.marshalls[this.name].errors
     const warnings = this.ctx.marshalls[this.name].warnings
     if ((errors && errors.length) || (warnings && warnings.length)) {

package/lib/marshalls/downloads.marshall.js

@@ -6,16 +6,16 @@ const MARSHALL_NAME = 'downloads'
 const DOWNLOAD_COUNT_THRESHOLD = 20 // threshold per month
 
 class Marshall extends BaseMarshall {
-  constructor(options) {
+  constructor (options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title() {
+  title () {
     return 'Checking package download popularity'
   }
 
-  validate(pkg) {
+  validate (pkg) {
     return this.packageRepoUtils.getDownloadInfo(pkg.packageName).then((downloadCount) => {
       if (downloadCount < DOWNLOAD_COUNT_THRESHOLD) {
         throw new Error(

package/lib/marshalls/expiredDomains.marshall.js

@@ -6,16 +6,16 @@ const dns = require('dns').promises
 const MARSHALL_NAME = 'maintainers_expired_emails'
 
 class Marshall extends BaseMarshall {
-  constructor(options) {
+  constructor (options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title() {
+  title () {
     return 'Detecting expired domains for authors account...'
   }
 
-  validate(pkg) {
+  validate (pkg) {
     return this.packageRepoUtils
       .getPackageInfo(pkg.packageName)
       .then((data) => {

package/lib/marshalls/index.js

@@ -4,7 +4,7 @@ const Listr = require('listr')
 const glob = require('glob')
 
 class Marshalls {
-  static collectMarshalls() {
+  static collectMarshalls () {
     return new Promise((resolve, reject) => {
       glob(
         this.GLOB_MARSHALLS,
@@ -23,7 +23,7 @@ class Marshalls {
     })
   }
 
-  static buildMarshallTasks(marshalls, config) {
+  static buildMarshallTasks (marshalls, config) {
     if (!marshalls || !Array.isArray(marshalls) || marshalls.length === 0) {
       return Promise.reject(new Error('unable to collect marshalls, or no marshalls found'))
     }
@@ -46,7 +46,7 @@ class Marshalls {
     return new Listr(marshallTasks, { exitOnError: false, concurrent: true })
   }
 
-  static tasks(options) {
+  static tasks (options) {
     return Marshalls.warmUpPackagesCache(options)
       .then(() => Marshalls.collectMarshalls())
       .then((marshalls) => {
@@ -59,7 +59,7 @@ class Marshalls {
       })
   }
 
-  static warmUpPackagesCache(options) {
+  static warmUpPackagesCache (options) {
     const fetchPackagesInfoPromises = []
     options.pkgs.forEach((packageMeta) => {
       fetchPackagesInfoPromises.push(
@@ -70,7 +70,7 @@ class Marshalls {
     return Promise.all(fetchPackagesInfoPromises)
   }
 
-  static runTasks(tasks, options) {
+  static runTasks (tasks, options) {
     return tasks.run({
       pkgs: options.pkgs,
       marshalls: {}

package/lib/marshalls/license.marshall.js

@@ -5,16 +5,16 @@ const BaseMarshall = require('./baseMarshall')
 const MARSHALL_NAME = 'license'
 
 class Marshall extends BaseMarshall {
-  constructor(options) {
+  constructor (options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title() {
+  title () {
     return 'Checking availability of a LICENSE'
   }
 
-  validate(pkg) {
+  validate (pkg) {
     return this.packageRepoUtils.getLicenseInfo(pkg.packageName).then((licenseContents) => {
       if (!licenseContents || licenseContents === 'ERROR: No LICENSE data found!') {
         throw new Error('package has no LICENSE file available')

package/lib/marshalls/readme.marshall.js

@@ -5,16 +5,16 @@ const BaseMarshall = require('./baseMarshall')
 const MARSHALL_NAME = 'readme'
 
 class Marshall extends BaseMarshall {
-  constructor(options) {
+  constructor (options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title() {
+  title () {
     return 'Checking availability of a README'
   }
 
-  validate(pkg) {
+  validate (pkg) {
     return this.packageRepoUtils.getReadmeInfo(pkg.packageName).then((readmeContents) => {
       if (!readmeContents || readmeContents === 'ERROR: No README data found!') {
         throw new Error('package has no README file available')

package/lib/marshalls/repo.marshall.js

@@ -6,16 +6,16 @@ const URL = require('url').URL
 const MARSHALL_NAME = 'repo'
 
 class Marshall extends BaseMarshall {
-  constructor(options) {
+  constructor (options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title() {
+  title () {
     return 'Identifying package repository...'
   }
 
-  validate(pkg) {
+  validate (pkg) {
     return this.packageRepoUtils.getPackageInfo(pkg.packageName).then((data) => {
       const lastVersionData =
         (data.versions &&

package/lib/marshalls/scripts.marshall.js

@@ -5,16 +5,16 @@ const BaseMarshall = require('./baseMarshall')
 const MARSHALL_NAME = 'scripts'
 
 class Marshall extends BaseMarshall {
-  constructor(options) {
+  constructor (options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title() {
+  title () {
     return 'Checking package for pre/post install scripts'
   }
 
-  validate(pkg) {
+  validate (pkg) {
     return this.packageRepoUtils.getPackageInfo(pkg.packageName).then((data) => {
       const packageVersion =
         pkg.packageVersion === 'latest'

package/lib/marshalls/signatures.marshall.js

@@ -6,16 +6,16 @@ const pacote = require('pacote')
 const MARSHALL_NAME = 'signatures'
 
 class Marshall extends BaseMarshall {
-  constructor(options) {
+  constructor (options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title() {
+  title () {
     return 'Verifying registry signatures for package'
   }
 
-  validate(pkg) {
+  validate (pkg) {
     // @TODO currently we're hardcoding the official npm registry
     // this should however allow for local proxies and other registries
     return this.fetchRegistryKeys()
@@ -32,7 +32,7 @@ class Marshall extends BaseMarshall {
       })
   }
 
-  fetchRegistryKeys() {
+  fetchRegistryKeys () {
     const registryHost = 'https://registry.npmjs.org'
     const registryKeysEndpoint = '/-/npm/v1/keys'
 

package/lib/marshalls/snyk.marshall.js

@@ -14,18 +14,18 @@ const SNYK_API_TOKEN = process.env.SNYK_TOKEN
 const SNYK_CONFIG_FILE = '.config/configstore/snyk.json'
 
 class Marshall extends BaseMarshall {
-  constructor(options) {
+  constructor (options) {
     super(options)
     this.name = MARSHALL_NAME
 
     this.snykApiToken = this.getSnykToken()
   }
 
-  title() {
+  title () {
     return 'Checking for known vulnerabilities'
   }
 
-  run(ctx, task) {
+  run (ctx, task) {
     const tasks = ctx.pkgs.reduce((prevPkg, currPkg) => {
       return prevPkg.concat(this.checkPackage(currPkg, ctx, task))
     }, [])
@@ -33,7 +33,7 @@ class Marshall extends BaseMarshall {
     return Promise.all(tasks)
   }
 
-  validate(pkg) {
+  validate (pkg) {
     return Promise.resolve()
       .then(() => {
         if (!pkg.packageVersion || pkg.packageVersion === 'latest') {
@@ -60,7 +60,7 @@ class Marshall extends BaseMarshall {
       })
   }
 
-  getSnykVulnInfoUnauthenticated({ packageName, packageVersion }) {
+  getSnykVulnInfoUnauthenticated ({ packageName, packageVersion }) {
     const url = encodeURI(`${SNYK_TEST_URL}/${packageName}/${packageVersion}?type=json`)
 
     return fetch(url)
@@ -77,7 +77,7 @@ class Marshall extends BaseMarshall {
       .catch(() => false)
   }
 
-  getSnykVulnInfo({ packageName, packageVersion } = {}) {
+  getSnykVulnInfo ({ packageName, packageVersion } = {}) {
     if (!this.snykApiToken) {
       return this.getSnykVulnInfoUnauthenticated({ packageName, packageVersion })
     }
@@ -102,7 +102,7 @@ class Marshall extends BaseMarshall {
       .catch(() => false)
   }
 
-  getSnykToken() {
+  getSnykToken () {
     if (SNYK_API_TOKEN) {
       return SNYK_API_TOKEN
     }

package/lib/packageManager.js

@@ -5,12 +5,12 @@ const childProcess = require('child_process')
 const DEFAULT_PKGMGR = 'npm'
 
 class packageManager {
-  static process(packageManagerOption) {
+  static process (packageManagerOption) {
     const detectedPackageManager = packageManager.validatePackageManager(packageManagerOption)
     return packageManager.spawnPackageManager(detectedPackageManager)
   }
 
-  static spawnPackageManager(packageManagerOption) {
+  static spawnPackageManager (packageManagerOption) {
     let args = []
 
     args = args.concat(process.argv.slice(2)).filter((item) => {
@@ -32,7 +32,7 @@ class packageManager {
     return Promise.resolve(child)
   }
 
-  static validatePackageManager(packageManagerOption) {
+  static validatePackageManager (packageManagerOption) {
     if (!packageManagerOption) {
       packageManagerOption = packageManager.getDefaultPackageManager()
     }
@@ -44,7 +44,7 @@ class packageManager {
     return packageManagerOption
   }
 
-  static getDefaultPackageManager() {
+  static getDefaultPackageManager () {
     return DEFAULT_PKGMGR
   }
 }

package/package.json

@@ -1,20 +1,20 @@
 {
   "name": "npq",
-  "version": "2.4.0",
-  "description": "marshall your npm/yarn package installs with high quality and class 🎖",
+  "version": "2.4.2",
+  "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",
     "npq-hero": "./bin/npq-hero.js"
   },
   "scripts": {
-    "lint": "standard --fix && eslint . --ignore-path .gitignore && yarn run lint:lockfile",
-    "lint:lockfile": "lockfile-lint --path yarn.lock --type yarn --validate-https --allowed-hosts npm yarn",
+    "lint": "standard --fix && eslint . --ignore-path .gitignore && npm run lint:lockfile",
+    "lint:lockfile": "lockfile-lint --path package-lock.json --type npm --validate-https --allowed-hosts npm npm",
     "test": "jest",
     "test:watch": "jest --watch",
     "coverage:view": "opn coverage/lcov-report/index.html",
     "commit": "git-cz",
     "format": "prettier --config .prettierrc.js --write '**/*.js'",
-    "docs": "yarn run docs:code && yarn run docs:api",
+    "docs": "npm run docs:code && npm run docs:api",
     "docs:api": "doxdox *.js --layout bootstrap --output docs/index.html",
     "docs:code": "docco *.js --output docs/code",
     "semantic-release": "semantic-release",
@@ -44,8 +44,6 @@
     "@commitlint/config-angular": "^8.0.0",
     "commitizen": "^3.0.0",
     "cz-conventional-changelog": "^2.1.0",
-    "docco": "^0.7.0",
-    "doxdox": "^3.0.0",
     "eslint": "^5.0.0",
     "eslint-plugin-import": "^2.2.0",
     "eslint-plugin-node": "^8.0.0",
@@ -53,7 +51,7 @@
     "husky": "^3.0.0",
     "jest": "^24.9.0",
     "lint-staged": "^13.1.0",
-    "lockfile-lint": "^2.0.1",
+    "lockfile-lint": "^4.12.1",
     "opn-cli": "^4.0.0",
     "prettier": "^2.8.3",
     "semantic-release": "21.0.2",
@@ -99,10 +97,10 @@
     "hooks": {
       "commit-msg": "commitlint --env HUSKY_GIT_PARAMS",
       "pre-commit": "lint-staged",
-      "pre-push": "yarn run lint && yarn run test",
+      "pre-push": "npm run lint && npm run test",
       "post-commit": "git status",
       "post-checkout": "git status",
-      "post-merge": "yarn install"
+      "post-merge": "npm install"
     }
   },
   "commitlint": {
@@ -112,8 +110,8 @@
   },
   "lint-staged": {
     "**/*.js": [
-      "yarn run format",
-      "yarn run lint",
+      "npm run format",
+      "npm run lint",
       "git add"
     ]
   },