npq 2.5.2 → 3.0.0

package/lib/marshalls/age.marshall.js

@@ -6,16 +6,16 @@ const MARSHALL_NAME = 'age'
 const PACKAGE_AGE_THRESHOLD = 22 // specified in days
 
 class Marshall extends BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title () {
+  title() {
     return 'Checking package maturity'
   }
 
-  validate (pkg) {
+  validate(pkg) {
     return this.packageRepoUtils.getPackageInfo(pkg.packageName).then((data) => {
       if (data && data.time && data.time.created) {
         const pkgCreatedDate = data.time.created

package/lib/marshalls/author.marshall.js

@@ -7,19 +7,19 @@ const Warning = require('../helpers/warning')
 const MARSHALL_NAME = 'author'
 
 class Marshall extends BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title () {
+  title() {
     return 'Identifying package author...'
   }
 
-  validate (pkg) {
+  validate(pkg) {
     return this.packageRepoUtils.getPackageInfo(pkg.packageName).then((data) => {
       const lastVersionData =
-        data.versions && data['dist-tags'] && data.versions[data['dist-tags']['latest']]
+        data.versions && data['dist-tags'] && data.versions[data['dist-tags'].latest]
 
       const hasAuthorEmail =
         (lastVersionData &&

package/lib/marshalls/baseMarshall.js

@@ -3,11 +3,11 @@
 const Warning = require('../helpers/warning')
 
 class BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     this.packageRepoUtils = options.packageRepoUtils
   }
 
-  init (ctx, task) {
+  init(ctx, task) {
     this.ctx = ctx
     this.task = task
 
@@ -19,7 +19,7 @@ class BaseMarshall {
     }
   }
 
-  run (ctx, task) {
+  run(ctx, task) {
     const tasks = ctx.pkgs.reduce((prevPkg, currPkg) => {
       return prevPkg.concat(this.checkPackage(currPkg, ctx, task))
     }, [])
@@ -27,7 +27,7 @@ class BaseMarshall {
     return Promise.all(tasks)
   }
 
-  checkPackage (pkg, ctx, task) {
+  checkPackage(pkg, ctx, task) {
     return this.validate(pkg)
       .then((data) => {
         task.output = `querying ${pkg.packageString}...`
@@ -47,13 +47,13 @@ class BaseMarshall {
       })
   }
 
-  isEnabled () {
+  isEnabled() {
     const isMarshallSilent = process.env[`MARSHALL_DISABLE_${this.name.toUpperCase()}`] || false
 
     return !isMarshallSilent
   }
 
-  setMessage (msg, isWarning) {
+  setMessage(msg, isWarning) {
     const messages = isWarning
       ? this.ctx.marshalls[this.name].warnings
       : this.ctx.marshalls[this.name].errors
@@ -64,7 +64,7 @@ class BaseMarshall {
     })
   }
 
-  handleMessages () {
+  handleMessages() {
     const errors = this.ctx.marshalls[this.name].errors
     const warnings = this.ctx.marshalls[this.name].warnings
     if ((errors && errors.length) || (warnings && warnings.length)) {

package/lib/marshalls/downloads.marshall.js

@@ -6,16 +6,16 @@ const MARSHALL_NAME = 'downloads'
 const DOWNLOAD_COUNT_THRESHOLD = 20 // threshold per month
 
 class Marshall extends BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title () {
+  title() {
     return 'Checking package download popularity'
   }
 
-  validate (pkg) {
+  validate(pkg) {
     return this.packageRepoUtils.getDownloadInfo(pkg.packageName).then((downloadCount) => {
       if (downloadCount < DOWNLOAD_COUNT_THRESHOLD) {
         throw new Error(

package/lib/marshalls/expiredDomains.marshall.js

@@ -6,25 +6,25 @@ const dns = require('dns').promises
 const MARSHALL_NAME = 'maintainers_expired_emails'
 
 class Marshall extends BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title () {
+  title() {
     return 'Detecting expired domains for authors account...'
   }
 
-  validate (pkg) {
+  validate(pkg) {
     return this.packageRepoUtils
       .getPackageInfo(pkg.packageName)
       .then((data) => {
         const lastVersionData =
-          data.versions && data['dist-tags'] && data.versions[data['dist-tags']['latest']]
+          data.versions && data['dist-tags'] && data.versions[data['dist-tags'].latest]
 
-        let maintainersAccounts = lastVersionData && lastVersionData.maintainers
+        const maintainersAccounts = lastVersionData && lastVersionData.maintainers
 
-        let testEmails = []
+        const testEmails = []
         for (const maintainerInfo of maintainersAccounts) {
           const maintainerEmail = maintainerInfo.email
           const emailDomain = maintainerEmail.split('@')[1]
@@ -34,7 +34,7 @@ class Marshall extends BaseMarshall {
         return Promise.all(testEmails)
       })
       .catch((error) => {
-        let emailHostname = error.hostname ? error.hostname : '<unknown>'
+        const emailHostname = error.hostname ? error.hostname : '<unknown>'
         throw new Error(
           'Unable to resolve domain for maintainer e-mail, could be an expired account: ' +
             emailHostname

package/lib/marshalls/index.js

@@ -1,29 +1,19 @@
 'use strict'
 
 const Listr = require('listr')
-const glob = require('glob')
+const { glob } = require('glob')
 
 class Marshalls {
-  static collectMarshalls () {
-    return new Promise((resolve, reject) => {
-      glob(
-        this.GLOB_MARSHALLS,
-        {
-          cwd: __dirname,
-          absolute: true
-        },
-        (err, files) => {
-          if (err) {
-            reject(err)
-          }
-
-          resolve(files)
-        }
-      )
+  static async collectMarshalls() {
+    const files = await glob(this.GLOB_MARSHALLS, {
+      cwd: __dirname,
+      absolute: true
     })
+
+    return files
   }
 
-  static buildMarshallTasks (marshalls, config) {
+  static buildMarshallTasks(marshalls, config) {
     if (!marshalls || !Array.isArray(marshalls) || marshalls.length === 0) {
       return Promise.reject(new Error('unable to collect marshalls, or no marshalls found'))
     }
@@ -46,7 +36,7 @@ class Marshalls {
     return new Listr(marshallTasks, { exitOnError: false, concurrent: true })
   }
 
-  static tasks (options) {
+  static tasks(options) {
     return Marshalls.warmUpPackagesCache(options)
       .then(() => Marshalls.collectMarshalls())
       .then((marshalls) => {
@@ -59,7 +49,7 @@ class Marshalls {
       })
   }
 
-  static warmUpPackagesCache (options) {
+  static warmUpPackagesCache(options) {
     const fetchPackagesInfoPromises = []
     options.pkgs.forEach((packageMeta) => {
       fetchPackagesInfoPromises.push(
@@ -70,7 +60,7 @@ class Marshalls {
     return Promise.all(fetchPackagesInfoPromises)
   }
 
-  static runTasks (tasks, options) {
+  static runTasks(tasks, options) {
     return tasks.run({
       pkgs: options.pkgs,
       marshalls: {}

package/lib/marshalls/license.marshall.js

@@ -5,16 +5,16 @@ const BaseMarshall = require('./baseMarshall')
 const MARSHALL_NAME = 'license'
 
 class Marshall extends BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title () {
+  title() {
     return 'Checking availability of a LICENSE'
   }
 
-  validate (pkg) {
+  validate(pkg) {
     return this.packageRepoUtils.getLicenseInfo(pkg.packageName).then((licenseContents) => {
       if (!licenseContents || licenseContents === 'ERROR: No LICENSE data found!') {
         throw new Error('package has no LICENSE file available')

package/lib/marshalls/provenance.marshall.js

@@ -1,22 +1,22 @@
 'use strict'
 
 const BaseMarshall = require('./baseMarshall')
-const fetch = require('node-fetch')
 const pacote = require('pacote')
+const Warning = require('../helpers/warning')
 
 const MARSHALL_NAME = 'provenance'
 
 class Marshall extends BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title () {
+  title() {
     return 'Verifying package provenance'
   }
 
-  validate (pkg) {
+  validate(pkg) {
     const validationMetadata = {}
 
     return this.packageRepoUtils
@@ -25,7 +25,7 @@ class Marshall extends BaseMarshall {
         const packageName = packageInfo.name
         const packageVersion =
           pkg.packageVersion === 'latest'
-            ? packageInfo['dist-tags'] && packageInfo['dist-tags']['latest']
+            ? packageInfo['dist-tags'] && packageInfo['dist-tags'].latest
             : this.packageRepoUtils.parsePackageVersion(pkg.packageVersion).version
 
         validationMetadata.name = packageName
@@ -41,15 +41,23 @@ class Marshall extends BaseMarshall {
           verifyAttestations: true,
           registry: 'https://registry.npmjs.org',
 
-          [`//registry.npmjs.org/:_keys`]: keys
+          '//registry.npmjs.org/:_keys': keys
         })
       })
       .then((metadata) => {
-        return metadata
+        if (!metadata || !metadata._attestations) {
+          throw new Warning(
+            'the package was published without any attestations. Proceed with care.'
+          )
+        }
+
+        const attestations = metadata._attestations
+
+        return attestations
       })
   }
 
-  fetchRegistryKeys () {
+  fetchRegistryKeys() {
     const registryHost = 'https://registry.npmjs.org'
     const registryKeysEndpoint = '/-/npm/v1/keys'
 

package/lib/marshalls/readme.marshall.js

@@ -5,16 +5,16 @@ const BaseMarshall = require('./baseMarshall')
 const MARSHALL_NAME = 'readme'
 
 class Marshall extends BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title () {
+  title() {
     return 'Checking availability of a README'
   }
 
-  validate (pkg) {
+  validate(pkg) {
     return this.packageRepoUtils.getReadmeInfo(pkg.packageName).then((readmeContents) => {
       if (!readmeContents || readmeContents === 'ERROR: No README data found!') {
         throw new Error('package has no README file available')

package/lib/marshalls/repo.marshall.js

@@ -1,21 +1,20 @@
 'use strict'
 
 const BaseMarshall = require('./baseMarshall')
-const fetch = require('node-fetch')
 const URL = require('url').URL
 const MARSHALL_NAME = 'repo'
 
 class Marshall extends BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title () {
+  title() {
     return 'Identifying package repository...'
   }
 
-  validate (pkg) {
+  validate(pkg) {
     return this.packageRepoUtils.getPackageInfo(pkg.packageName).then((data) => {
       const lastVersionData =
         (data.versions &&
@@ -29,7 +28,7 @@ class Marshall extends BaseMarshall {
           urlStructure = new URL(lastVersionData.repository.url)
           urlOfGitRepository = new URL(`https://${urlStructure.host}${urlStructure.pathname}`)
         } catch (error) {
-          throw new Error(`no valid repository is associated with the package`)
+          throw new Error('no valid repository is associated with the package')
         }
         return fetch(urlOfGitRepository.href).catch(() => {
           throw new Error(

package/lib/marshalls/scripts.marshall.js

@@ -5,20 +5,20 @@ const BaseMarshall = require('./baseMarshall')
 const MARSHALL_NAME = 'scripts'
 
 class Marshall extends BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title () {
+  title() {
     return 'Checking package for pre/post install scripts'
   }
 
-  validate (pkg) {
+  validate(pkg) {
     return this.packageRepoUtils.getPackageInfo(pkg.packageName).then((data) => {
       const packageVersion =
         pkg.packageVersion === 'latest'
-          ? data['dist-tags'] && data['dist-tags']['latest']
+          ? data['dist-tags'] && data['dist-tags'].latest
           : this.packageRepoUtils.parsePackageVersion(pkg.packageVersion).version
 
       if (!packageVersion) {
@@ -29,7 +29,7 @@ class Marshall extends BaseMarshall {
         data &&
         data.versions &&
         data.versions[packageVersion] &&
-        data.versions[packageVersion]['scripts']
+        data.versions[packageVersion].scripts
 
       // blacklisted scripts due to possible malicious intent:
       const blacklistScripts = ['install', 'preinstall', 'postinstall']

package/lib/marshalls/signatures.marshall.js

@@ -1,22 +1,21 @@
 'use strict'
 
 const BaseMarshall = require('./baseMarshall')
-const fetch = require('node-fetch')
 const pacote = require('pacote')
 
 const MARSHALL_NAME = 'signatures'
 
 class Marshall extends BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title () {
+  title() {
     return 'Verifying registry signatures for package'
   }
 
-  validate (pkg) {
+  validate(pkg) {
     // @TODO currently we're hardcoding the official npm registry
     // this should however allow for local proxies and other registries
     return this.fetchRegistryKeys()
@@ -25,7 +24,7 @@ class Marshall extends BaseMarshall {
           verifySignatures: true,
           registry: 'https://registry.npmjs.org',
 
-          [`//registry.npmjs.org/:_keys`]: keys
+          '//registry.npmjs.org/:_keys': keys
         })
       })
       .then((metadata) => {
@@ -33,7 +32,7 @@ class Marshall extends BaseMarshall {
       })
   }
 
-  fetchRegistryKeys () {
+  fetchRegistryKeys() {
     const registryHost = 'https://registry.npmjs.org'
     const registryKeysEndpoint = '/-/npm/v1/keys'
 

package/lib/marshalls/snyk.marshall.js

@@ -3,7 +3,6 @@
 const fs = require('fs')
 const os = require('os')
 const path = require('path')
-const fetch = require('node-fetch')
 const BaseMarshall = require('./baseMarshall')
 
 const MARSHALL_NAME = 'snyk'
@@ -14,18 +13,18 @@ const SNYK_API_TOKEN = process.env.SNYK_TOKEN
 const SNYK_CONFIG_FILE = '.config/configstore/snyk.json'
 
 class Marshall extends BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
 
     this.snykApiToken = this.getSnykToken()
   }
 
-  title () {
+  title() {
     return 'Checking for known vulnerabilities'
   }
 
-  run (ctx, task) {
+  run(ctx, task) {
     const tasks = ctx.pkgs.reduce((prevPkg, currPkg) => {
       return prevPkg.concat(this.checkPackage(currPkg, ctx, task))
     }, [])
@@ -33,7 +32,7 @@ class Marshall extends BaseMarshall {
     return Promise.all(tasks)
   }
 
-  validate (pkg) {
+  validate(pkg) {
     return Promise.resolve()
       .then(() => {
         if (!pkg.packageVersion || pkg.packageVersion === 'latest') {
@@ -60,7 +59,7 @@ class Marshall extends BaseMarshall {
       })
   }
 
-  getSnykVulnInfoUnauthenticated ({ packageName, packageVersion }) {
+  getSnykVulnInfoUnauthenticated({ packageName, packageVersion }) {
     const url = encodeURI(`${SNYK_TEST_URL}/${packageName}/${packageVersion}?type=json`)
 
     return fetch(url)
@@ -77,7 +76,7 @@ class Marshall extends BaseMarshall {
       .catch(() => false)
   }
 
-  getSnykVulnInfo ({ packageName, packageVersion } = {}) {
+  getSnykVulnInfo({ packageName, packageVersion } = {}) {
     if (!this.snykApiToken) {
       return this.getSnykVulnInfoUnauthenticated({ packageName, packageVersion })
     }
@@ -102,7 +101,7 @@ class Marshall extends BaseMarshall {
       .catch(() => false)
   }
 
-  getSnykToken () {
+  getSnykToken() {
     if (SNYK_API_TOKEN) {
       return SNYK_API_TOKEN
     }
@@ -111,7 +110,7 @@ class Marshall extends BaseMarshall {
 
     try {
       if (fs.statSync(snykConfigPath)) {
-        let snykConfig = require(snykConfigPath)
+        const snykConfig = require(snykConfigPath)
         if (snykConfig && snykConfig.api) {
           return snykConfig.api
         }

package/lib/packageManager.js

@@ -5,12 +5,12 @@ const childProcess = require('child_process')
 const DEFAULT_PKGMGR = 'npm'
 
 class packageManager {
-  static process (packageManagerOption) {
+  static process(packageManagerOption) {
     const detectedPackageManager = packageManager.validatePackageManager(packageManagerOption)
     return packageManager.spawnPackageManager(detectedPackageManager)
   }
 
-  static spawnPackageManager (packageManagerOption) {
+  static spawnPackageManager(packageManagerOption) {
     let args = []
 
     args = args.concat(process.argv.slice(2)).filter((item) => {
@@ -32,7 +32,7 @@ class packageManager {
     return Promise.resolve(child)
   }
 
-  static validatePackageManager (packageManagerOption) {
+  static validatePackageManager(packageManagerOption) {
     if (!packageManagerOption) {
       packageManagerOption = packageManager.getDefaultPackageManager()
     }
@@ -44,7 +44,7 @@ class packageManager {
     return packageManagerOption
   }
 
-  static getDefaultPackageManager () {
+  static getDefaultPackageManager() {
     return DEFAULT_PKGMGR
   }
 }