npq 3.11.3 → 3.11.5

package/lib/marshalls/age.marshall.js

@@ -19,48 +19,49 @@ class Marshall extends BaseMarshall {
     return 'Checking package maturity'
   }
 
-  validate(pkg) {
-    let packageData = null
-    return this.packageRepoUtils
-      .getPackageInfo(pkg.packageName)
-      .then((data) => {
-        if (data && data.time && data.time.created) {
-          packageData = data
-          const pkgCreatedDate = data.time.created
-          const dateDiff = Date.now() - Date.parse(pkgCreatedDate)
+  async validate(pkg) {
+    const data = await this.packageRepoUtils.getPackageInfo(pkg.packageName)
 
-          if (dateDiff < PACKAGE_AGE_THRESHOLD) {
-            throw new Error(
-              `Detected a newly published package (created < ${PACKAGE_AGE_THRESHOLD} days) act carefully`
-            )
-          }
+    if (!data || !data.time || !data.time.created) {
+      throw new Warning('Could not determine package age')
+    }
 
-          return pkg
-        } else {
-          throw new Warning('Could not determine package age')
-        }
-      })
-      .then((pkg) => {
-        return this.packageRepoUtils.getSemVer(pkg.packageName, pkg.packageVersion)
-      })
-      .then((versionResolved) => {
-        const versionReleaseDate = packageData.time[versionResolved]
-        const versionDateDiff = new Date() - new Date(versionReleaseDate)
+    const pkgCreatedDate = data.time.created
+    const dateDiff = Date.now() - Date.parse(pkgCreatedDate)
+    const thresholdMs = PACKAGE_AGE_THRESHOLD * 24 * 60 * 60 * 1000
 
-        const versionDateDiffInDays = Math.round(versionDateDiff / (1000 * 60 * 60 * 24))
+    if (dateDiff < thresholdMs) {
+      throw new Error(
+        `Detected a newly published package (created < ${PACKAGE_AGE_THRESHOLD} days) act carefully`
+      )
+    }
 
-        let timeAgoText = 'days'
-        let timeAgoNumber = versionDateDiffInDays
+    const packageVersion = await this.resolvePackageVersion(
+      pkg.packageName,
+      pkg.packageVersion,
+      data
+    )
 
-        if (versionDateDiffInDays >= 365) {
-          timeAgoText = 'years'
-          timeAgoNumber = Math.floor(versionDateDiffInDays / 365)
-        }
+    if (!packageVersion || !data.time[packageVersion]) {
+      throw new Warning('Could not determine package version release date')
+    }
 
-        if (versionDateDiffInDays >= PACKAGE_AGE_UNMAINTAINED_RISK) {
-          throw new Warning(`Detected an old package (created ${timeAgoNumber} ${timeAgoText} ago)`)
-        }
-      })
+    const versionReleaseDate = data.time[packageVersion]
+    const versionDateDiff = Date.now() - Date.parse(versionReleaseDate)
+    const versionDateDiffInDays = Math.round(versionDateDiff / (1000 * 60 * 60 * 24))
+    const unmaintainedThresholdMs = PACKAGE_AGE_UNMAINTAINED_RISK * 24 * 60 * 60 * 1000
+
+    let timeAgoText = 'days'
+    let timeAgoNumber = versionDateDiffInDays
+
+    if (versionDateDiffInDays >= 365) {
+      timeAgoText = 'years'
+      timeAgoNumber = Math.floor(versionDateDiffInDays / 365)
+    }
+
+    if (versionDateDiff >= unmaintainedThresholdMs) {
+      throw new Warning(`Detected an old package (created ${timeAgoNumber} ${timeAgoText} ago)`)
+    }
   }
 }
 

package/lib/marshalls/baseMarshall.js

@@ -1,5 +1,6 @@
 'use strict'
 
+const semver = require('semver')
 const util = require('node:util')
 const Warning = require('../helpers/warning')
 const { marshallCategories } = require('./constants')
@@ -67,6 +68,38 @@ class BaseMarshall {
       message: msg.message
     })
   }
+
+  /**
+   * Resolves a package version string to an actual semver version
+   * Handles dist-tags (latest, beta, etc.) and direct semver versions
+   * @param {string} packageName - The package name
+   * @param {string} versionSpec - The version specification (could be dist-tag or semver)
+   * @param {Object} packageData - Optional package data to avoid re-fetching
+   * @returns {Promise<string|null>} - The resolved semver version or null if not found
+   */
+
+  async resolvePackageVersion(packageName, versionSpec, packageData) {
+    if (typeof versionSpec !== 'string' || versionSpec.trim() === '') return null
+    const data = packageData || (await this.packageRepoUtils.getPackageInfo(packageName))
+
+    if (!data) return null
+
+    // Handle dist-tags first
+    if (data['dist-tags'] && data['dist-tags'][versionSpec]) {
+      return data['dist-tags'][versionSpec]
+    }
+
+    // Handle semver ranges and exact versions using all available versions
+    if (data.versions) {
+      const availableVersions = Object.keys(data.versions)
+      const resolved = semver.maxSatisfying(availableVersions, versionSpec)
+      if (resolved) return resolved
+    }
+
+    // Fallback for simple parsing if range resolution fails
+    const parsed = this.packageRepoUtils.parsePackageVersion(versionSpec)
+    return parsed ? parsed.version : null
+  }
 }
 
 module.exports = BaseMarshall

package/lib/marshalls/deprecation.marshall.js

@@ -16,27 +16,32 @@ class Marshall extends BaseMarshall {
     return 'Checking package for deprecation flag'
   }
 
-  validate(pkg) {
-    return this.packageRepoUtils.getPackageInfo(pkg.packageName).then((data) => {
-      const packageVersion =
-        pkg.packageVersion === 'latest'
-          ? data['dist-tags'] && data['dist-tags'].latest
-          : this.packageRepoUtils.parsePackageVersion(pkg.packageVersion).version
-
-      if (!packageVersion) {
-        return true
-      }
-
-      const packageDeprecated =
-        data &&
-        data.versions &&
-        data.versions[packageVersion] &&
-        data.versions[packageVersion].deprecated
-
-      if (packageDeprecated) {
-        throw new Error(`Package deprecated: ${packageDeprecated}`)
-      }
-    })
+  async validate(pkg) {
+    const data = await this.packageRepoUtils.getPackageInfo(pkg.packageName)
+
+    if (!data) {
+      return true
+    }
+
+    const packageVersion = await this.resolvePackageVersion(
+      pkg.packageName,
+      pkg.packageVersion,
+      data
+    )
+
+    if (!packageVersion) {
+      return true
+    }
+
+    const packageDeprecated =
+      data &&
+      data.versions &&
+      data.versions[packageVersion] &&
+      data.versions[packageVersion].deprecated
+
+    if (packageDeprecated) {
+      throw new Error(`Package deprecated: ${packageDeprecated}`)
+    }
   }
 }
 

package/lib/marshalls/newbin.marshall.js

@@ -25,9 +25,10 @@ class NewBinMarshall extends BaseMarshall {
       return
     }
 
-    const targetVersionString = await this.packageRepoUtils.getSemVer(
+    const targetVersionString = await this.resolvePackageVersion(
       pkg.packageName,
-      pkg.packageVersion
+      pkg.packageVersion,
+      fullPackageInfo
     )
 
     if (!targetVersionString || !fullPackageInfo.versions[targetVersionString]) {

package/lib/marshalls/provenance.marshall.js

@@ -22,6 +22,8 @@ class Marshall extends BaseMarshall {
   validate(pkg) {
     const validationMetadata = {}
 
+    // removed debug log
+
     return (
       this.packageRepoUtils
         .getPackageInfo(pkg.packageName)

package/lib/marshalls/scripts.marshall.js

@@ -16,40 +16,46 @@ class Marshall extends BaseMarshall {
     return 'Checking package for pre/post install scripts'
   }
 
-  validate(pkg) {
-    return this.packageRepoUtils.getPackageInfo(pkg.packageName).then((data) => {
-      const packageVersion =
-        pkg.packageVersion === 'latest'
-          ? data['dist-tags'] && data['dist-tags'].latest
-          : this.packageRepoUtils.parsePackageVersion(pkg.packageVersion).version
-
-      if (!packageVersion) {
-        return true
-      }
+  async validate(pkg) {
+    const data = await this.packageRepoUtils.getPackageInfo(pkg.packageName)
+
+    if (!data) {
+      return true
+    }
 
-      const packageScripts =
-        data &&
-        data.versions &&
-        data.versions[packageVersion] &&
-        data.versions[packageVersion].scripts
-
-      // blacklisted scripts due to possible malicious intent:
-      const blacklistScripts = ['install', 'preinstall', 'postinstall']
-
-      blacklistScripts.forEach((scriptName) => {
-        if (
-          packageScripts &&
-          Object.prototype.hasOwnProperty.call(packageScripts, scriptName) &&
-          packageScripts[scriptName].length > 0
-        ) {
-          throw new Error(
-            `Detected a possible malicious intent script, audit required: ${scriptName}: ${packageScripts[scriptName]}`
-          )
-        }
-      })
+    const packageVersion = await this.resolvePackageVersion(
+      pkg.packageName,
+      pkg.packageVersion,
+      data
+    )
 
+    if (!packageVersion) {
       return true
+    }
+
+    const packageScripts =
+      data &&
+      data.versions &&
+      data.versions[packageVersion] &&
+      data.versions[packageVersion].scripts
+
+    // blacklisted scripts due to possible malicious intent:
+    const blacklistScripts = ['install', 'preinstall', 'postinstall']
+
+    blacklistScripts.forEach((scriptName) => {
+      if (
+        packageScripts &&
+        packageScripts[scriptName] &&
+        String(packageScripts[scriptName]).length > 0
+      ) {
+        const scriptContent = packageScripts[scriptName]
+        throw new Error(
+          `Detected a possible malicious intent script, audit required: ${scriptName}: ${scriptContent}`
+        )
+      }
     })
+
+    return true
   }
 }
 

package/lib/marshalls/version-maturity.marshall.js

@@ -17,50 +17,45 @@ class Marshall extends BaseMarshall {
     return 'Checking version maturity'
   }
 
-  validate(pkg) {
-    let packageData = null
-    return this.packageRepoUtils
-      .getPackageInfo(pkg.packageName)
-      .then((data) => {
-        if (data && data.time) {
-          packageData = data
-          return pkg
-        } else {
-          throw new Error('Could not determine package version information')
-        }
-      })
-      .then((pkg) => {
-        return this.packageRepoUtils.getSemVer(pkg.packageName, pkg.packageVersion)
-      })
-      .then((versionResolved) => {
-        const versionReleaseDate = packageData.time[versionResolved]
-
-        if (!versionReleaseDate) {
-          throw new Error(`Could not determine release date for version ${versionResolved}`)
-        }
-
-        const versionDateDiff = new Date() - new Date(versionReleaseDate)
-        const versionDateDiffInDays = Math.round(versionDateDiff / (1000 * 60 * 60 * 24))
-
-        if (versionDateDiffInDays < VERSION_AGE_THRESHOLD) {
-          let timeAgoText = 'days'
-          let timeAgoNumber = versionDateDiffInDays
-
-          if (versionDateDiffInDays === 0) {
-            timeAgoText = 'hours'
-            const versionDateDiffInHours = Math.round(versionDateDiff / (1000 * 60 * 60))
-            timeAgoNumber = versionDateDiffInHours
-          } else if (versionDateDiffInDays === 1) {
-            timeAgoText = 'day'
-          }
-
-          throw new Error(
-            `Detected a recently published version (published ${timeAgoNumber} ${timeAgoText} ago) - consider waiting for community review`
-          )
-        }
-
-        return pkg
-      })
+  async validate(pkg) {
+    const data = await this.packageRepoUtils.getPackageInfo(pkg.packageName)
+
+    if (!data || !data.time) {
+      throw new Error('Could not determine package version information')
+    }
+
+    const packageVersion = await this.resolvePackageVersion(
+      pkg.packageName,
+      pkg.packageVersion,
+      data
+    )
+
+    if (!packageVersion || !Object.prototype.hasOwnProperty.call(data.time, packageVersion)) {
+      throw new Error(`Could not determine release date for version ${packageVersion}`)
+    }
+
+    const versionReleaseDate = data.time[packageVersion]
+    const versionDateDiff = new Date() - new Date(versionReleaseDate)
+    const versionDateDiffInDays = Math.round(versionDateDiff / (1000 * 60 * 60 * 24))
+
+    if (versionDateDiffInDays < VERSION_AGE_THRESHOLD) {
+      let timeAgoText = 'days'
+      let timeAgoNumber = versionDateDiffInDays
+
+      if (versionDateDiffInDays === 0) {
+        timeAgoText = 'hours'
+        const versionDateDiffInHours = Math.round(versionDateDiff / (1000 * 60 * 60))
+        timeAgoNumber = versionDateDiffInHours
+      } else if (versionDateDiffInDays === 1) {
+        timeAgoText = 'day'
+      }
+
+      throw new Error(
+        `Detected a recently published version (published ${timeAgoNumber} ${timeAgoText} ago) - consider waiting for community review`
+      )
+    }
+
+    return pkg
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "3.11.3",
+  "version": "3.11.5",
   "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",