npq 3.19.0 → 3.19.2

package/README.md

@@ -4,7 +4,6 @@ npq allows you to audit npm packages _before_ you install them
 [![license](https://img.shields.io/npm/l/npq)](LICENSE)
 [![codecov](https://img.shields.io/codecov/c/gh/lirantal/npq/main)](https://codecov.io/gh/lirantal/npq)
 [![CI](https://img.shields.io/github/actions/workflow/status/lirantal/npq/main.yml?branch=main&label=CI&logo=github)](https://github.com/lirantal/npq/actions/workflows/main.yml?query=branch%3Amain)
-[![Known Vulnerabilities](https://snyk.io/test/github/lirantal/npq/badge.svg)](https://snyk.io/test/github/lirantal/npq)
 [![Security Responsible Disclosure](https://img.shields.io/badge/Security-Responsible%20Disclosure-yellow)](SECURITY.md)
 
 TL;DR how to use npq:

package/lib/marshalls/snyk.marshall.js

@@ -9,6 +9,30 @@ const { marshallCategories } = require('./constants')
 const MARSHALL_NAME = 'snyk'
 const SNYK_PACKAGE_PAGE = 'https://snyk.io/vuln/npm:'
 const SNYK_CONFIG_FILE = '.config/configstore/snyk.json'
+const OSV_MALICIOUS_ORIGINS_KEY = 'malicious-packages-origins'
+
+function isOsvVulnMalicious(vuln) {
+  if (!vuln || typeof vuln !== 'object') {
+    return false
+  }
+
+  const ds = vuln.database_specific
+  if (ds && typeof ds === 'object' && !Array.isArray(ds)) {
+    if (Object.prototype.hasOwnProperty.call(ds, OSV_MALICIOUS_ORIGINS_KEY)) {
+      const origins = ds[OSV_MALICIOUS_ORIGINS_KEY]
+      if (Array.isArray(origins)) {
+        return true
+      }
+    }
+  }
+
+  const summary = vuln.summary
+  if (typeof summary === 'string' && summary.toLowerCase().startsWith('malicious')) {
+    return true
+  }
+
+  return false
+}
 
 class Marshall extends BaseMarshall {
   constructor(options) {
@@ -55,18 +79,14 @@ class Marshall extends BaseMarshall {
         }
 
         if (data.issuesCount && data.issuesCount > 0) {
+          const packageSecurityInfo = `${SNYK_PACKAGE_PAGE}${encodeURIComponent(pkg.packageName)}`
+          if (data.isMaliciousPackage) {
+            throw new Error(`Malicious package found: ${packageSecurityInfo}`)
+          }
           if (this.snykApiToken) {
-            const packageSecurityInfo = `${SNYK_PACKAGE_PAGE}${encodeURIComponent(pkg.packageName)}`
-            if (data.isMaliciousPackage) {
-              throw new Error(`Malicious package found: ${packageSecurityInfo}`)
-            }
-
             throw new Error(`${data.issuesCount} vulnerable path(s) found: ${packageSecurityInfo}`)
-          } else {
-            throw new Error(
-              `${data.issuesCount} vulnerabilities found by OSV for ${pkg.packageName}`
-            )
           }
+          throw new Error(`${data.issuesCount} vulnerabilities found by OSV for ${pkg.packageName}`)
         }
 
         return data
@@ -93,12 +113,7 @@ class Marshall extends BaseMarshall {
       .then((response) => response.json())
       .then((data) => {
         if (data && data.vulns) {
-          const isMaliciousPackage = data.vulns.some(
-            (vuln) =>
-              vuln.database_specific &&
-              vuln.database_specific['malicious-packages-origins'] &&
-              vuln.database_specific['malicious-packages-origins'].length > 0
-          )
+          const isMaliciousPackage = data.vulns.some((vuln) => isOsvVulnMalicious(vuln))
 
           return {
             issuesCount: data.vulns.length,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "3.19.0",
+  "version": "3.19.2",
   "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",