npq 3.14.0 → 3.15.1

package/README.md

@@ -37,9 +37,11 @@ npq install express
 * Package has a LICENSE file
 * Package has pre/post install scripts
 
-If npq is prompted to continue with the install, it simply hands over the actual package install job to the package manager (npm by default, or as specified via the `NPQ_PKG_MGR` environment variable). Note that if a package manager is specified via command-line options, it will override the `NPQ_PKG_MGR` environment variable.
+**IMPORTANT**: npq by default uses an auto-continue mode when warnings are detected (no errors), waiting 15 seconds before proceeding with the installation. You can disable this behavior via the `--disable-auto-continue` CLI flag or the `NPQ_DISABLE_AUTO_CONTINUE=true` environment variable to enforce a strict review and security hardened installs. See [the auto-continue documentation](docs/feature/auto-continue.md) for more details.
 
-DISCLAIMER: there's no guaranteed absolute safety; a malicious or vulnerable package could still exist that has no security vulnerabilities publicly disclosed and passes npq's checks.
+When npq completes its signal checks it hands over the actual package install job to the package manager (npm by default, or as specified via the `NPQ_PKG_MGR` environment variable).
+
+**DISCLAIMER**: there's no guaranteed absolute safety; a malicious or vulnerable package could still exist that has no security vulnerabilities publicly disclosed and passes npq's checks.
 
 ## Demo
 
@@ -81,12 +83,24 @@ If you're using `yarn`, `pnpm`, or generally want to explicitly tell npq which p
 
 Examples:
 
-**Using yarn:**
+**Using yarn 1.x:**
 
 ```bash
 alias yarn="NPQ_PKG_MGR=yarn npq-hero"
 ```
 
+**Using yarn 4.x:**
+
+```bash
+NPQ_PKG_MGR=yarn yarn run npq-hero
+```
+
+or 
+
+```bash
+NPQ_PKG_MGR=yarn yarn exec npq-hero
+```
+
 **Using pnpm:**
 
 ```bash
@@ -165,6 +179,31 @@ npq install express --dry-run
 npq install express --plain
 ```
 
+### Disable auto-continue countdown
+
+By default, when npq detects only warnings (no errors), it automatically proceeds with installation after a 15-second countdown. To disable this behavior and always require explicit confirmation:
+
+**Using the CLI flag:**
+
+```sh
+npq install express --disable-auto-continue
+```
+
+**Using the environment variable:**
+
+```sh
+export NPQ_DISABLE_AUTO_CONTINUE=true
+npq install express
+```
+
+Or set it permanently in your shell profile (`.bashrc`, `.zshrc`, etc.):
+
+```sh
+export NPQ_DISABLE_AUTO_CONTINUE=true
+```
+
+When auto-continue is disabled, npq will always prompt for explicit confirmation before proceeding with installation, even when only warnings are detected.
+
 ## Learn Node.js Security
 
 <div align="center">
@@ -185,17 +224,21 @@ npq install express --plain
 
 ## FAQ
 
-1. **Can I use NPQ without having npm or yarn?**
+1. **What is the difference between `npq` and `npq-hero`?**
+
+* `npq` is meant to be its own stand-alone CLI so it has command line flags like `--dry-run` and others (see `npq --help`). However, when you want to alias the `npm` CLI to NPQ you should use `npq-hero` as the executable of the alias to npm (e.g: `alias npm=npq`), which means `npq-hero` can't have its own command-line flags because they could conflict with the `npm` executable.
+
+2. **Can I use NPQ without having npm or yarn?**
 
 * NPQ will audit a package for possible security issues, but it isn't a replacement for npm or yarn. When you choose to continue installing the package, it will offload the installation process to your choice of either npm or yarn.
 
-2. **How is NPQ different from npm audit?**
+3. **How is NPQ different from npm audit?**
 
 * `npm install` will install a module even if it has vulnerabilities; NPQ will display the issues detected, and prompt the user for confirmation on whether to proceed installing it.
 * NPQ will run synthetic checks, called [marshalls](https://github.com/lirantal/npq#marshalls), on the characteristics of a module, such as whether the module you are going to install has a `pre-install` script which can be potentially harmful for your system and prompt you whether to install it. Whereas `npm audit` will not perform any such checks, and only consults a vulnerability database for known security issues.
 * `npm audit` is closer in functionality to what Snyk does, rather than what NPQ does.
 
-3. **Do I require a Snyk API key in order to use NPQ?**
+4. **Do I require a Snyk API key in order to use NPQ?**
 
 * It's not required. If NPQ is unable to detect a Snyk API key for the user running NPQ, then it will skip the database vulnerabilities check. We do, however, greatly encourage you to use Snyk, and connect it with NPQ for broader security.
 

package/bin/npq-hero.js

@@ -14,6 +14,7 @@ const { Spinner } = require('../lib/helpers/cliSpinner')
 const { promiseThrottleHelper } = require('../lib/helpers/promiseThrottler')
 
 const PACKAGE_MANAGER_TOOL = process.env.NPQ_PKG_MGR
+const DISABLE_AUTO_CONTINUE = process.env.NPQ_DISABLE_AUTO_CONTINUE === 'true'
 
 const cliArgs = CliParser.parseArgsMinimal()
 
@@ -80,6 +81,14 @@ marshall
     } else {
       if (result && result.countWarnings > 0) {
         console.log()
+        // Check if auto-continue is disabled via environment variable
+        if (DISABLE_AUTO_CONTINUE) {
+          return cliPrompt.prompt({
+            name: 'install',
+            message: 'Continue install ?',
+            default: false
+          })
+        }
         return cliPrompt.autoContinue({
           name: 'install',
           message: 'Auto-continue with install in... ',

package/bin/npq.js

@@ -106,6 +106,14 @@ Promise.resolve()
     } else {
       if (result && result.countWarnings > 0) {
         console.log()
+        // Check if auto-continue is disabled via CLI flag or environment variable
+        if (cliArgs.disableAutoContinue) {
+          return cliPrompt.prompt({
+            name: 'install',
+            message: 'Continue install ?',
+            default: false
+          })
+        }
         return cliPrompt.autoContinue({
           name: 'install',
           message: 'Auto-continue with install in... ',

package/lib/cli.js

@@ -67,6 +67,7 @@ class CliParser {
       plain: { type: 'boolean' },
       packageManager: { type: 'string' },
       pkgMgr: { type: 'string' },
+      'disable-auto-continue': { type: 'boolean' },
       help: { type: 'boolean', short: 'h' },
       version: { type: 'boolean', short: 'v' }
     }
@@ -87,12 +88,17 @@ Commands:
   install [package...]  install a package
 
 Options:
-      --dry-run           Run checks only, don't install
-      --plain             Force non-rich text output
-      --packageManager    Package Manager to use (default: npm)
-      --pkgMgr            Alias for packageManager
-  -h, --help              Show help
-  -v, --version           Show version
+      --dry-run               Run checks only, don't install
+      --plain                 Force non-rich text output
+      --packageManager        Package Manager to use (default: npm)
+      --pkgMgr                Alias for packageManager
+      --disable-auto-continue Disable auto-continue countdown, always prompt
+  -h, --help                  Show help
+  -v, --version               Show version
+
+Environment Variables:
+  NPQ_PKG_MGR                 Package manager to use (default: npm)
+  NPQ_DISABLE_AUTO_CONTINUE   Set to 'true' to disable auto-continue
 
 Examples:
   npq install express
@@ -114,7 +120,9 @@ curated by Liran Tal at https://github.com/lirantal/npq`)
       packages: normalizedPackages,
       packageManager: values.packageManager || values.pkgMgr || process.env.NPQ_PKG_MGR || 'npm',
       dryRun: values['dry-run'] || false,
-      plain: values.plain || false
+      plain: values.plain || false,
+      disableAutoContinue:
+        values['disable-auto-continue'] || process.env.NPQ_DISABLE_AUTO_CONTINUE === 'true'
     }
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "3.14.0",
+  "version": "3.15.1",
   "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",
@@ -45,7 +45,7 @@
   "dependencies": {
     "fastest-levenshtein": "^1.0.16",
     "npm-package-arg": "^13.0.0",
-    "semver": "^7.7.2",
+    "semver": "^7.7.3",
     "sigstore": "^3.1.0",
     "ssri": "^12.0.0"
   },