npq 3.13.5 → 3.15.0

package/README.md

@@ -37,9 +37,11 @@ npq install express
 * Package has a LICENSE file
 * Package has pre/post install scripts
 
-If npq is prompted to continue with the install, it simply hands over the actual package install job to the package manager (npm by default, or as specified via the `NPQ_PKG_MGR` environment variable). Note that if a package manager is specified via command-line options, it will override the `NPQ_PKG_MGR` environment variable.
+**IMPORTANT**: npq by default uses an auto-continue mode when warnings are detected (no errors), waiting 15 seconds before proceeding with the installation. You can disable this behavior via the `--disable-auto-continue` CLI flag or the `NPQ_DISABLE_AUTO_CONTINUE=true` environment variable to enforce a strict review and security hardened installs. See [the auto-continue documentation](docs/feature/auto-continue.md) for more details.
 
-DISCLAIMER: there's no guaranteed absolute safety; a malicious or vulnerable package could still exist that has no security vulnerabilities publicly disclosed and passes npq's checks.
+When npq completes its signal checks it hands over the actual package install job to the package manager (npm by default, or as specified via the `NPQ_PKG_MGR` environment variable).
+
+**DISCLAIMER**: there's no guaranteed absolute safety; a malicious or vulnerable package could still exist that has no security vulnerabilities publicly disclosed and passes npq's checks.
 
 ## Demo
 
@@ -165,6 +167,31 @@ npq install express --dry-run
 npq install express --plain
 ```
 
+### Disable auto-continue countdown
+
+By default, when npq detects only warnings (no errors), it automatically proceeds with installation after a 15-second countdown. To disable this behavior and always require explicit confirmation:
+
+**Using the CLI flag:**
+
+```sh
+npq install express --disable-auto-continue
+```
+
+**Using the environment variable:**
+
+```sh
+export NPQ_DISABLE_AUTO_CONTINUE=true
+npq install express
+```
+
+Or set it permanently in your shell profile (`.bashrc`, `.zshrc`, etc.):
+
+```sh
+export NPQ_DISABLE_AUTO_CONTINUE=true
+```
+
+When auto-continue is disabled, npq will always prompt for explicit confirmation before proceeding with installation, even when only warnings are detected.
+
 ## Learn Node.js Security
 
 <div align="center">

package/bin/npq-hero.js

@@ -14,6 +14,7 @@ const { Spinner } = require('../lib/helpers/cliSpinner')
 const { promiseThrottleHelper } = require('../lib/helpers/promiseThrottler')
 
 const PACKAGE_MANAGER_TOOL = process.env.NPQ_PKG_MGR
+const DISABLE_AUTO_CONTINUE = process.env.NPQ_DISABLE_AUTO_CONTINUE === 'true'
 
 const cliArgs = CliParser.parseArgsMinimal()
 
@@ -80,6 +81,14 @@ marshall
     } else {
       if (result && result.countWarnings > 0) {
         console.log()
+        // Check if auto-continue is disabled via environment variable
+        if (DISABLE_AUTO_CONTINUE) {
+          return cliPrompt.prompt({
+            name: 'install',
+            message: 'Continue install ?',
+            default: false
+          })
+        }
         return cliPrompt.autoContinue({
           name: 'install',
           message: 'Auto-continue with install in... ',

package/bin/npq.js

@@ -106,6 +106,14 @@ Promise.resolve()
     } else {
       if (result && result.countWarnings > 0) {
         console.log()
+        // Check if auto-continue is disabled via CLI flag or environment variable
+        if (cliArgs.disableAutoContinue) {
+          return cliPrompt.prompt({
+            name: 'install',
+            message: 'Continue install ?',
+            default: false
+          })
+        }
         return cliPrompt.autoContinue({
           name: 'install',
           message: 'Auto-continue with install in... ',

package/lib/cli.js

@@ -67,6 +67,7 @@ class CliParser {
       plain: { type: 'boolean' },
       packageManager: { type: 'string' },
       pkgMgr: { type: 'string' },
+      'disable-auto-continue': { type: 'boolean' },
       help: { type: 'boolean', short: 'h' },
       version: { type: 'boolean', short: 'v' }
     }
@@ -87,12 +88,17 @@ Commands:
   install [package...]  install a package
 
 Options:
-      --dry-run           Run checks only, don't install
-      --plain             Force non-rich text output
-      --packageManager    Package Manager to use (default: npm)
-      --pkgMgr            Alias for packageManager
-  -h, --help              Show help
-  -v, --version           Show version
+      --dry-run               Run checks only, don't install
+      --plain                 Force non-rich text output
+      --packageManager        Package Manager to use (default: npm)
+      --pkgMgr                Alias for packageManager
+      --disable-auto-continue Disable auto-continue countdown, always prompt
+  -h, --help                  Show help
+  -v, --version               Show version
+
+Environment Variables:
+  NPQ_PKG_MGR                 Package manager to use (default: npm)
+  NPQ_DISABLE_AUTO_CONTINUE   Set to 'true' to disable auto-continue
 
 Examples:
   npq install express
@@ -114,7 +120,9 @@ curated by Liran Tal at https://github.com/lirantal/npq`)
       packages: normalizedPackages,
       packageManager: values.packageManager || values.pkgMgr || process.env.NPQ_PKG_MGR || 'npm',
       dryRun: values['dry-run'] || false,
-      plain: values.plain || false
+      plain: values.plain || false,
+      disableAutoContinue:
+        values['disable-auto-continue'] || process.env.NPQ_DISABLE_AUTO_CONTINUE === 'true'
     }
   }
 

package/lib/marshalls/snyk.marshall.js

@@ -7,10 +7,7 @@ const BaseMarshall = require('./baseMarshall')
 const { marshallCategories } = require('./constants')
 
 const MARSHALL_NAME = 'snyk'
-const SNYK_API_URL = 'https://snyk.io/api/v1/vuln/npm'
-
 const SNYK_PACKAGE_PAGE = 'https://snyk.io/vuln/npm:'
-const SNYK_API_TOKEN = process.env.SNYK_TOKEN
 const SNYK_CONFIG_FILE = '.config/configstore/snyk.json'
 
 class Marshall extends BaseMarshall {
@@ -20,6 +17,11 @@ class Marshall extends BaseMarshall {
     this.categoryId = marshallCategories.SupplyChainSecurity.id
 
     this.snykApiToken = this.getSnykToken()
+    this.snykApiUrl = this.getSnykApiUrl()
+  }
+
+  getSnykApiUrl() {
+    return process.env.SNYK_API_URL || process.env.SNYK_API || 'https://snyk.io/api/v1/vuln/npm'
   }
 
   title() {
@@ -119,7 +121,7 @@ class Marshall extends BaseMarshall {
       return this.getOsvVulnerabilityInfo({ packageName, packageVersion })
     }
 
-    const url = `${SNYK_API_URL}/${encodeURIComponent(packageName + '@' + packageVersion)}`
+    const url = `${this.snykApiUrl}/${encodeURIComponent(packageName + '@' + packageVersion)}`
 
     return fetch(url, {
       headers: {
@@ -150,8 +152,11 @@ class Marshall extends BaseMarshall {
   }
 
   getSnykToken() {
-    if (SNYK_API_TOKEN) {
-      return SNYK_API_TOKEN
+    // Check for SNYK_API_TOKEN first, then fall back to SNYK_TOKEN
+    const snykApiToken = process.env.SNYK_API_TOKEN || process.env.SNYK_TOKEN
+
+    if (snykApiToken) {
+      return snykApiToken
     }
 
     const snykConfigPath = path.join(os.homedir(), SNYK_CONFIG_FILE)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "3.13.5",
+  "version": "3.15.0",
   "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",
@@ -45,7 +45,7 @@
   "dependencies": {
     "fastest-levenshtein": "^1.0.16",
     "npm-package-arg": "^13.0.0",
-    "semver": "^7.7.2",
+    "semver": "^7.7.3",
     "sigstore": "^3.1.0",
     "ssri": "^12.0.0"
   },