npq 3.15.4 → 3.16.1

package/README.md

@@ -7,6 +7,16 @@ npq allows you to audit npm packages _before_ you install them
 [![Known Vulnerabilities](https://snyk.io/test/github/lirantal/npq/badge.svg)](https://snyk.io/test/github/lirantal/npq)
 [![Security Responsible Disclosure](https://img.shields.io/badge/Security-Responsible%20Disclosure-yellow)](SECURITY.md)
 
+TL;DR how to use npq:
+
+```sh
+$ npx npq install express --dry-run
+```
+
+_What it does: the `npx` tool downloads and execute `npq` package, runs an install check for the `express` package and `--dry-run` means npq exists regardless of success/errors_.
+
+Here's a screenshot of npq in action:
+
 ![npq demo screenshot](.github/npq.png)
 
 Media coverage about npq:
@@ -133,7 +143,7 @@ Note: `npq` by default will offload all commands and their arguments to the `npm
 | version-maturity | Will show a warning if the specific version being installed was published less than 7 days ago | Helps identify recently published versions that may not have been reviewed by the community yet
 | newBin | Will show a warning if the package version being installed introduces a new command-line binary (via the `bin` field in `package.json`) that was not present in its previous version. | Helps identify potentially unexpected new executables being added to your `node_modules/.bin/` directory.
 | typosquatting | Will show a warning if the package name is similar to a popular package name, which could indicate a potential typosquatting attack. | Helps identify packages that may be trying to trick users into installing them by mimicking popular package names.
-| deprecation | Will show a warning if the package version being installed is deprecated. | Helps identify packages that are no longer maintained or recommended for use.
+| deprecation | Will show a warning if the package version is deprecated on npm or if its GitHub repository has been archived. | Helps identify packages that are no longer maintained or recommended for use. Set `GITHUB_TOKEN` environment variable for higher GitHub API rate limits.
 
 ### Disabling Marshalls
 

package/lib/helpers/levenshteinDistance.js

@@ -0,0 +1,78 @@
+'use strict'
+
+/**
+ * Calculates the Levenshtein distance between two strings.
+ * Uses the Wagner-Fischer algorithm with single-row space optimization
+ * and optional early termination when distance exceeds maxDistance.
+ *
+ * @param {string} a - First string
+ * @param {string} b - Second string
+ * @param {number} [maxDistance] - Optional maximum distance threshold for early termination
+ * @returns {number} The Levenshtein edit distance between the two strings
+ */
+function levenshteinDistance(a, b, maxDistance) {
+  // Handle edge cases
+  if (a === b) return 0
+  if (a.length === 0) return b.length
+  if (b.length === 0) return a.length
+
+  // Ensure a is the shorter string for space optimization
+  if (a.length > b.length) {
+    const temp = a
+    a = b
+    b = temp
+  }
+
+  const aLen = a.length
+  const bLen = b.length
+
+  // Early termination: if length difference exceeds maxDistance, no need to compute
+  if (maxDistance !== undefined && bLen - aLen >= maxDistance) {
+    return bLen - aLen
+  }
+
+  // Initialize the previous row (represents distances for empty string a prefix)
+  let prevRow = new Array(aLen + 1)
+  for (let i = 0; i <= aLen; i++) {
+    prevRow[i] = i
+  }
+
+  // Current row for computation
+  let currRow = new Array(aLen + 1)
+
+  // Fill in the matrix row by row
+  for (let j = 1; j <= bLen; j++) {
+    currRow[0] = j
+
+    let rowMin = currRow[0]
+
+    for (let i = 1; i <= aLen; i++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1
+
+      currRow[i] = Math.min(
+        prevRow[i] + 1, // deletion
+        currRow[i - 1] + 1, // insertion
+        prevRow[i - 1] + cost // substitution
+      )
+
+      if (currRow[i] < rowMin) {
+        rowMin = currRow[i]
+      }
+    }
+
+    // Early termination: if minimum value in current row exceeds maxDistance,
+    // the final distance will also exceed maxDistance
+    if (maxDistance !== undefined && rowMin >= maxDistance) {
+      return rowMin
+    }
+
+    // Swap rows
+    const temp = prevRow
+    prevRow = currRow
+    currRow = temp
+  }
+
+  return prevRow[aLen]
+}
+
+module.exports = { levenshteinDistance }

package/lib/helpers/packageRepoUtils.js

@@ -93,6 +93,85 @@ class PackageRepoUtils {
       throw new Error(`Could not find dist-tag ${packageVersion} for package ${packageName}`)
     }
   }
+
+  /**
+   * Extract GitHub owner and repo from a repository URL
+   * @param {string} repoUrl - Repository URL (e.g., "git+https://github.com/owner/repo.git")
+   * @returns {{owner: string, repo: string} | null} - Owner and repo, or null if not a GitHub URL
+   */
+  extractGitHubRepoFromUrl(repoUrl) {
+    if (!repoUrl || typeof repoUrl !== 'string') {
+      return null
+    }
+
+    // Match GitHub URLs in various formats:
+    // - git+https://github.com/owner/repo.git
+    // - https://github.com/owner/repo.git
+    // - https://github.com/owner/repo
+    // - git://github.com/owner/repo.git
+    // - git@github.com:owner/repo.git
+    const httpsPattern = /github\.com[/:]([\w.-]+)\/([\w.-]+?)(?:\.git)?$/i
+    const match = repoUrl.match(httpsPattern)
+
+    if (match) {
+      return {
+        owner: match[1],
+        repo: match[2]
+      }
+    }
+
+    return null
+  }
+
+  /**
+   * Check if a GitHub repository is archived
+   * @param {string} owner - Repository owner
+   * @param {string} repo - Repository name
+   * @returns {Promise<boolean>} - True if archived, false otherwise
+   * @throws {Error} - On rate limit or API errors
+   */
+  async isGitHubRepoArchived(owner, repo) {
+    const headers = {
+      Accept: 'application/vnd.github.v3+json',
+      'User-Agent': 'npq-package-checker'
+    }
+
+    // Use GITHUB_TOKEN if available for higher rate limits
+    if (process.env.GITHUB_TOKEN) {
+      headers.Authorization = `token ${process.env.GITHUB_TOKEN}`
+    }
+
+    const response = await fetch(`https://api.github.com/repos/${owner}/${repo}`, {
+      headers
+    })
+
+    if (response.status === 403) {
+      const rateLimitRemaining = response.headers.get('x-ratelimit-remaining')
+      if (rateLimitRemaining === '0') {
+        throw new Error(
+          'GitHub API rate limit exceeded - deprecation marshall could not evaluate repository archive status. ' +
+            'Set GITHUB_TOKEN environment variable for higher rate limits.'
+        )
+      }
+      throw new Error(
+        `GitHub API access forbidden for ${owner}/${repo} - deprecation marshall could not evaluate repository archive status`
+      )
+    }
+
+    if (response.status === 404) {
+      // Repository doesn't exist or is private - can't determine archive status
+      return false
+    }
+
+    if (!response.ok) {
+      throw new Error(
+        `GitHub API error (${response.status}) - deprecation marshall could not evaluate repository archive status`
+      )
+    }
+
+    const data = await response.json()
+    return data.archived === true
+  }
 }
 
 module.exports = PackageRepoUtils

package/lib/helpers/sourcePackages.js

@@ -12,9 +12,20 @@ async function getProjectPackages() {
     const packageJSON = await fs.readFile(packageJSONPath, 'utf-8')
     const packageData = JSON.parse(packageJSON)
     if (packageData && packageData.dependencies) {
-      packages = Object.keys(packageData.dependencies).map((dep) => {
-        return `${dep}@${packageData.dependencies[dep]}`
-      })
+      packages = [
+        ...packages,
+        ...Object.keys(packageData.dependencies).map((dep) => {
+          return `${dep}@${packageData.dependencies[dep]}`
+        })
+      ]
+    }
+    if (packageData && packageData.devDependencies) {
+      packages = [
+        ...packages,
+        ...Object.keys(packageData.devDependencies).map((dep) => {
+          return `${dep}@${packageData.devDependencies[dep]}`
+        })
+      ]
     }
 
     return packages

package/lib/marshalls/deprecation.marshall.js

@@ -42,6 +42,38 @@ class Marshall extends BaseMarshall {
     if (packageDeprecated) {
       throw new Error(`Package deprecated: ${packageDeprecated}`)
     }
+
+    // Check if the GitHub repository is archived
+    await this.checkGitHubRepoArchived(data)
+  }
+
+  /**
+   * Check if the package's GitHub repository is archived
+   * @param {object} data - Package data from npm registry
+   * @throws {Error} - If repository is archived or on API rate limit
+   */
+  async checkGitHubRepoArchived(data) {
+    const repoUrl = data.repository?.url
+
+    if (!repoUrl) {
+      return
+    }
+
+    const githubRepo = this.packageRepoUtils.extractGitHubRepoFromUrl(repoUrl)
+
+    if (!githubRepo) {
+      // @TODO: Add support for GitLab and Bitbucket repository archive detection
+      return
+    }
+
+    const isArchived = await this.packageRepoUtils.isGitHubRepoArchived(
+      githubRepo.owner,
+      githubRepo.repo
+    )
+
+    if (isArchived) {
+      throw new Error('Package repository has been archived on GitHub')
+    }
   }
 }
 

package/lib/marshalls/typosquatting.marshall.js

@@ -4,7 +4,7 @@ const BaseMarshall = require('./baseMarshall')
 const { marshallCategories } = require('./constants')
 
 const path = require('path')
-const { distance } = require('fastest-levenshtein')
+const { levenshteinDistance } = require('../helpers/levenshteinDistance')
 const topPackagesRawJSON = require(path.join(__dirname, '../../data/top-packages.json'))
 
 const MARSHALL_NAME = 'typosquatting'
@@ -21,7 +21,7 @@ class Marshall extends BaseMarshall {
   }
 
   validate(pkg) {
-    let levenshteinDistance = null
+    let editDistance = null
     let similarPackages = []
     return new Promise((resolve, reject) => {
       // If package is within an allow-list
@@ -36,9 +36,9 @@ class Marshall extends BaseMarshall {
           return resolve([])
         }
 
-        levenshteinDistance = distance(pkg.packageName, popularPackageNameInRepository)
+        editDistance = levenshteinDistance(pkg.packageName, popularPackageNameInRepository)
 
-        if (levenshteinDistance > 0 && levenshteinDistance < 3) {
+        if (editDistance > 0 && editDistance < 3) {
           similarPackages.push(popularPackageNameInRepository)
         }
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "3.15.4",
+  "version": "3.16.1",
   "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",
@@ -43,7 +43,6 @@
     "access": "public"
   },
   "dependencies": {
-    "fastest-levenshtein": "^1.0.16",
     "npm-package-arg": "^13.0.2",
     "semver": "^7.7.3",
     "sigstore": "^3.1.0",