npq 3.0.2 → 3.2.0

package/lib/marshalls/age.marshall.js

@@ -1,6 +1,7 @@
 'use strict'
 
 const BaseMarshall = require('./baseMarshall')
+const { marshallCategories } = require('./constants')
 
 const MARSHALL_NAME = 'age'
 const PACKAGE_AGE_THRESHOLD = 22 // specified in days
@@ -9,6 +10,7 @@ class Marshall extends BaseMarshall {
   constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
+    this.categoryId = marshallCategories.PackageHealth.id
   }
 
   title() {

package/lib/marshalls/author.marshall.js

@@ -2,7 +2,7 @@
 
 const BaseMarshall = require('./baseMarshall')
 const validator = require('validator')
-const Warning = require('../helpers/warning')
+const { marshallCategories } = require('./constants')
 
 const MARSHALL_NAME = 'author'
 
@@ -10,38 +10,69 @@ class Marshall extends BaseMarshall {
   constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
+    this.categoryId = marshallCategories.SupplyChainSecurity.id
   }
 
   title() {
     return 'Identifying package author...'
   }
 
-  validate(pkg) {
-    return this.packageRepoUtils.getPackageInfo(pkg.packageName).then((data) => {
-      const lastVersionData =
-        data.versions && data['dist-tags'] && data.versions[data['dist-tags'].latest]
-
-      const hasAuthorEmail =
-        (lastVersionData &&
-          lastVersionData.author &&
-          lastVersionData.author.email &&
-          validator.isEmail(lastVersionData.author.email)) ||
-        (data.versions &&
-          lastVersionData &&
-          lastVersionData.authors &&
-          lastVersionData.authors.filter &&
-          lastVersionData.authors.filter(
-            (author) => author.email && validator.isEmail(author.email).length
-          ))
-
-      if (!hasAuthorEmail) {
-        throw new Warning(
-          'the package description has no e-mail associated with author(s). Proceed with care.'
-        )
+  /**
+   * What do we check?
+   * 1. Who is the user who published the package? in the pakument's `_npmUser` field
+   * 2. Is this the first time we see this user publishing a package?
+   *   If so, halt and report.
+   * 3. Start from first version to latest version and check if they published
+   *   the package before.
+   *   If they did, and the difference between this published version date and
+   *   first is more than 30 days then halt and report.
+   * @param {*} pkg
+   * @returns
+   */
+  async validate(pkg) {
+    const pakument = await this.packageRepoUtils.getPackageInfo(pkg.packageName)
+
+    // @TODO fix to work for both explicit versions (1.0.0) and also
+    // for dis-tags (latest)
+    const npmUser = pakument.versions[pkg.packageVersion]._npmUser
+    if (!npmUser || !npmUser.email) {
+      throw new Error('could not determine publishing user for this package version')
+    }
+
+    if (!validator.isEmail(npmUser.email)) {
+      throw new Error('the publishing user has no valid email address')
+    }
+
+    let firstVersionForUser = null
+    const versionPublishedDateString = pakument.time[pkg.packageVersion]
+    for (const [version, versionMetadata] of Object.entries(pakument.versions)) {
+      if (versionMetadata._npmUser && versionMetadata._npmUser.email === npmUser.email) {
+        firstVersionForUser = versionMetadata
+        break
       }
+    }
+
+    if (!firstVersionForUser || firstVersionForUser.version === pkg.packageVersion) {
+      throw new Error(
+        `The user ${npmUser.name} <${npmUser.email}> published this package for the first time only ${dateDiffInDays} days ago. Proceed with care.`
+      )
+    }
+
+    const firstPublishedDateString = pakument.time[firstVersionForUser.version]
+
+    const dateDiffInMs = new Date(versionPublishedDateString) - new Date(firstPublishedDateString)
+    let dateDiffInDays = 0
+    if (dateDiffInMs > 0) {
+      dateDiffInDays = Math.round(dateDiffInMs / (1000 * 60 * 60 * 24))
+    }
+
+    if (dateDiffInDays <= 30) {
+      throw new Error(
+        `The user ${npmUser.name} <${npmUser.email}> published this package for the first time only ${dateDiffInDays} days ago. Proceed with care.`
+      )
+    }
 
-      return data
-    })
+    return versionPublishedDateString
   }
 }
 

package/lib/marshalls/baseMarshall.js

@@ -1,10 +1,12 @@
 'use strict'
 
 const Warning = require('../helpers/warning')
+const { marshallCategories } = require('./constants')
 
 class BaseMarshall {
   constructor(options) {
     this.packageRepoUtils = options.packageRepoUtils
+    this.categoryId = marshallCategories.PackageHealth.id
   }
 
   init(ctx, task) {

package/lib/marshalls/constants.js

@@ -0,0 +1,16 @@
+const marshallCategories = {
+  SupplyChainSecurity: {
+    id: 'SupplyChainSecurity',
+    title: 'Supply Chain Security'
+  },
+  PackageHealth: {
+    id: 'PackageHealth',
+    title: 'Package Health'
+  },
+  MalwareDetection: {
+    id: 'MalwareDetection',
+    title: 'Malware Detection'
+  }
+}
+
+module.exports.marshallCategories = marshallCategories

package/lib/marshalls/downloads.marshall.js

@@ -1,6 +1,7 @@
 'use strict'
 
 const BaseMarshall = require('./baseMarshall')
+const { marshallCategories } = require('./constants')
 
 const MARSHALL_NAME = 'downloads'
 const DOWNLOAD_COUNT_THRESHOLD = 20 // threshold per month
@@ -9,6 +10,7 @@ class Marshall extends BaseMarshall {
   constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
+    this.categoryId = marshallCategories.MalwareDetection.id
   }
 
   title() {

package/lib/marshalls/expiredDomains.marshall.js

@@ -1,6 +1,7 @@
 'use strict'
 
 const BaseMarshall = require('./baseMarshall')
+const { marshallCategories } = require('./constants')
 const dns = require('dns').promises
 
 const MARSHALL_NAME = 'maintainers_expired_emails'
@@ -9,6 +10,7 @@ class Marshall extends BaseMarshall {
   constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
+    this.categoryId = marshallCategories.MalwareDetection.id
   }
 
   title() {

package/lib/marshalls/index.js

@@ -2,6 +2,7 @@
 
 const { Listr } = require('listr2')
 const { glob } = require('glob')
+const { marshallCategories } = require('./constants')
 
 class Marshalls {
   static async collectMarshalls() {
@@ -13,7 +14,7 @@ class Marshalls {
     return files
   }
 
-  static buildMarshallTasks(marshalls, config) {
+  static async buildMarshallTasks(marshalls, config) {
     if (!marshalls || !Array.isArray(marshalls) || marshalls.length === 0) {
       return Promise.reject(new Error('unable to collect marshalls, or no marshalls found'))
     }
@@ -25,15 +26,42 @@ class Marshalls {
 
       return prev.concat({
         title: marshall.title(),
+        categoryId: marshall.categoryId,
         enabled: (ctx) => marshall.isEnabled(ctx),
-        task: (ctx, task) => {
+        task: async (ctx, task) => {
           marshall.init(ctx, task)
-          return marshall.run(ctx, task).then(() => marshall.handleMessages())
+          await marshall.run(ctx, task)
+          const messages = marshall.handleMessages()
+          return messages
         }
       })
     }, [])
 
-    return new Listr(marshallTasks, { exitOnError: false, concurrent: true })
+    const allMarshallTasksByCategories = Object.keys(marshallCategories).map((categoryId) => {
+      const category = marshallCategories[categoryId]
+      const filteredMarshallTasks = marshallTasks.filter((marshall) => {
+        return marshall.categoryId === category.id
+      })
+
+      const marshallsInCategory = {
+        title: category.title,
+        enabled: true,
+        task: () => {
+          return new Listr(filteredMarshallTasks, {
+            exitOnError: false,
+            concurrent: true,
+            rendererOptions: { collapseSubtasks: false }
+          })
+        }
+      }
+      return marshallsInCategory
+    })
+
+    return new Listr(allMarshallTasksByCategories, {
+      exitOnError: false,
+      concurrent: true,
+      rendererOptions: { collapseSubtasks: false }
+    })
   }
 
   static tasks(options) {

package/lib/marshalls/license.marshall.js

@@ -1,6 +1,7 @@
 'use strict'
 
 const BaseMarshall = require('./baseMarshall')
+const { marshallCategories } = require('./constants')
 
 const MARSHALL_NAME = 'license'
 
@@ -8,6 +9,7 @@ class Marshall extends BaseMarshall {
   constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
+    this.categoryId = marshallCategories.PackageHealth.id
   }
 
   title() {

package/lib/marshalls/provenance.marshall.js

@@ -3,6 +3,7 @@
 const BaseMarshall = require('./baseMarshall')
 const pacote = require('pacote')
 const Warning = require('../helpers/warning')
+const { marshallCategories } = require('./constants')
 
 const MARSHALL_NAME = 'provenance'
 
@@ -10,6 +11,7 @@ class Marshall extends BaseMarshall {
   constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
+    this.categoryId = marshallCategories.SupplyChainSecurity.id
   }
 
   title() {

package/lib/marshalls/readme.marshall.js

@@ -1,6 +1,7 @@
 'use strict'
 
 const BaseMarshall = require('./baseMarshall')
+const { marshallCategories } = require('./constants')
 
 const MARSHALL_NAME = 'readme'
 
@@ -8,6 +9,7 @@ class Marshall extends BaseMarshall {
   constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
+    this.categoryId = marshallCategories.PackageHealth.id
   }
 
   title() {

package/lib/marshalls/repo.marshall.js

@@ -1,6 +1,7 @@
 'use strict'
 
 const BaseMarshall = require('./baseMarshall')
+const { marshallCategories } = require('./constants')
 const URL = require('url').URL
 const MARSHALL_NAME = 'repo'
 
@@ -8,6 +9,7 @@ class Marshall extends BaseMarshall {
   constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
+    this.categoryId = marshallCategories.MalwareDetection.id
   }
 
   title() {

package/lib/marshalls/scripts.marshall.js

@@ -1,6 +1,7 @@
 'use strict'
 
 const BaseMarshall = require('./baseMarshall')
+const { marshallCategories } = require('./constants')
 
 const MARSHALL_NAME = 'scripts'
 
@@ -8,6 +9,7 @@ class Marshall extends BaseMarshall {
   constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
+    this.categoryId = marshallCategories.MalwareDetection.id
   }
 
   title() {

package/lib/marshalls/signatures.marshall.js

@@ -2,6 +2,7 @@
 
 const BaseMarshall = require('./baseMarshall')
 const pacote = require('pacote')
+const { marshallCategories } = require('./constants')
 
 const MARSHALL_NAME = 'signatures'
 
@@ -9,6 +10,7 @@ class Marshall extends BaseMarshall {
   constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
+    this.categoryId = marshallCategories.SupplyChainSecurity.id
   }
 
   title() {

package/lib/marshalls/snyk.marshall.js

@@ -4,6 +4,7 @@ const fs = require('fs')
 const os = require('os')
 const path = require('path')
 const BaseMarshall = require('./baseMarshall')
+const { marshallCategories } = require('./constants')
 
 const MARSHALL_NAME = 'snyk'
 const SNYK_API_URL = 'https://snyk.io/api/v1/vuln/npm'
@@ -16,6 +17,7 @@ class Marshall extends BaseMarshall {
   constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
+    this.categoryId = marshallCategories.SupplyChainSecurity.id
 
     this.snykApiToken = this.getSnykToken()
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "3.0.2",
+  "version": "3.2.0",
   "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",