npq 3.19.6 → 3.21.0

package/lib/marshalls/baseMarshall.js

@@ -2,6 +2,8 @@
 
 const semver = require('semver')
 const util = require('node:util')
+const NotEvaluated = require('../helpers/notEvaluated')
+const { RegistryError } = require('../helpers/registryErrors')
 const Warning = require('../helpers/warning')
 const { marshallCategories } = require('./constants')
 
@@ -9,6 +11,7 @@ class BaseMarshall {
   constructor(options) {
     this.debug = util.debuglog('npq')
     this.packageRepoUtils = options.packageRepoUtils
+    this.registryClient = options.registryClient
     this.categoryId = marshallCategories.PackageHealth.id
   }
 
@@ -19,6 +22,7 @@ class BaseMarshall {
       status: null,
       errors: [],
       warnings: [],
+      notEvaluated: [],
       data: {},
       marshall: this.name,
       categoryId: this.categoryId
@@ -42,13 +46,22 @@ class BaseMarshall {
         return data
       })
       .catch((err) => {
-        this.setMessage(
-          {
-            pkg: pkg.packageString,
-            message: err.message
-          },
-          Boolean(err instanceof Warning)
-        )
+        if (err instanceof RegistryError) {
+          throw err
+        }
+
+        const message = {
+          pkg: pkg.packageString,
+          message: err.message
+        }
+
+        if (err instanceof NotEvaluated) {
+          this.setNotEvaluated(message)
+          return undefined
+        }
+
+        this.setMessage(message, Boolean(err instanceof Warning))
+        return undefined
       })
   }
 
@@ -69,6 +82,13 @@ class BaseMarshall {
     })
   }
 
+  setNotEvaluated(msg) {
+    this.ctx.marshalls[this.name].notEvaluated.push({
+      pkg: msg.pkg,
+      message: msg.message
+    })
+  }
+
   /**
    * Resolves a package version string to an actual semver version
    * Handles dist-tags (latest, beta, etc.) and direct semver versions

package/lib/marshalls/index.js

@@ -2,6 +2,7 @@
 
 const fs = require('node:fs')
 const path = require('node:path')
+const { RegistryError } = require('../helpers/registryErrors')
 
 class Marshalls {
   static async collectMarshalls() {
@@ -20,7 +21,8 @@ class Marshalls {
     }
 
     const config = {
-      packageRepoUtils: options.packageRepoUtils
+      packageRepoUtils: options.packageRepoUtils,
+      registryClient: options.registryClient
     }
 
     const marshallTasks = marshalls.reduce((prev, curr) => {
@@ -96,6 +98,7 @@ class Marshalls {
               status: null,
               errors: [{ pkg: options.pkgs[index].packageName, message: 'Package not found' }],
               warnings: [],
+              notEvaluated: [],
               data: {},
               categoryId: 'PackageHealth'
             }
@@ -119,7 +122,8 @@ class Marshalls {
     const packagesToProcess = options.pkgs
     if (packagesToProcess.length > 0) {
       const marshallTasks = await Marshalls.buildMarshallTasks(marshalls, {
-        packageRepoUtils: options.packageRepoUtils
+        packageRepoUtils: options.packageRepoUtils,
+        registryClient: options.registryClient
       })
 
       for (const marshall of marshallTasks) {
@@ -130,6 +134,9 @@ class Marshalls {
           })
           marshallResults.push(res.marshalls)
         } catch (error) {
+          if (error instanceof RegistryError) {
+            throw error
+          }
           console.error(`Error running task ${marshall.title}:`, error)
         }
       }

package/lib/marshalls/provenance.marshall.js

@@ -4,6 +4,8 @@ const semver = require('semver')
 const BaseMarshall = require('./baseMarshall')
 const NpmRegistry = require('../helpers/npmRegistry')
 const Warning = require('../helpers/warning')
+const NotEvaluated = require('../helpers/notEvaluated')
+const { RegistryError } = require('../helpers/registryErrors')
 const { marshallCategories } = require('./constants')
 
 const MARSHALL_NAME = 'provenance'
@@ -88,115 +90,80 @@ class Marshall extends BaseMarshall {
     }
   }
 
-  validate(pkg) {
+  async validate(pkg) {
     const validationMetadata = {}
-    const npmRegistry = new NpmRegistry({
-      registry: 'https://registry.npmjs.org'
-    })
-
-    return this.packageRepoUtils
-      .getPackageInfo(pkg.packageName)
-      .then(async (packageInfo) => {
-        const packageName = packageInfo.name
-
-        // Use the resolvePackageVersion method to handle version ranges properly
-        const packageVersion = await this.resolvePackageVersion(
-          pkg.packageName,
-          pkg.packageVersion,
-          packageInfo
-        )
+    const verifier = new NpmRegistry()
+
+    try {
+      const packageInfo = await this.packageRepoUtils.getPackageInfo(pkg.packageName)
+      validationMetadata.name = packageInfo.name
+      validationMetadata.version = await this.resolvePackageVersion(
+        pkg.packageName,
+        pkg.packageVersion,
+        packageInfo
+      )
+      validationMetadata.packageInfo = packageInfo
 
-        validationMetadata.name = packageName
-        validationMetadata.version = packageVersion
-        validationMetadata.packageInfo = packageInfo
-
-        if (!validationMetadata.version) {
-          throw new Error('Unable to find version or dist-tag for package')
-        }
-
-        return validationMetadata
-      })
-      .then((validationMetadata) => {
-        return this.fetchRegistryKeys().then((keys) => {
-          return npmRegistry
-            .getManifest(`${validationMetadata.name}@${validationMetadata.version}`)
-            .then((manifest) => npmRegistry.verifyAttestations(manifest, keys))
-        })
-      })
-      .then((metadata) => {
-        if (!metadata || !metadata._attestations) {
-          this.throwIfProvenanceRegression(validationMetadata)
-          throw new Warning('the package was published without any attestations')
-        }
-
-        const attestations = metadata._attestations
-        return attestations
-      })
-      .catch((error) => {
-        // We can ignore this type of error, false positive
-        // See: https://github.com/lirantal/npq/issues/329
-        if (error.code === 'EATTESTATIONVERIFY' && error.message.includes('malformed checkpoint')) {
-          return []
-        }
-
-        if (
-          error instanceof Error &&
-          error.message === 'Unable to find version or dist-tag for package'
-        ) {
-          throw error
-        }
-
-        if (
-          error instanceof Warning &&
-          (error.message.includes('Error fetching registry keys') ||
-            error.message === 'the package was published without any attestations')
-        ) {
-          throw error
-        }
-
-        if (shouldConsiderProvenanceRegression(error)) {
-          this.throwIfProvenanceRegression(validationMetadata)
-        }
-
-        if (error.message.includes('Package has no attestations to verify')) {
-          throw new Warning(
-            `Unable to verify provenance: the package was published without any attestations`
-          )
-        }
-
-        this.debug(
-          '\nUnable to verify provenance for package %s@%s: %s',
-          validationMetadata.name,
-          validationMetadata.version,
-          error.message
+      if (!validationMetadata.version) {
+        throw new Error('Unable to find version or dist-tag for package')
+      }
+
+      const manifest = await this.registryClient.getManifest(
+        `${pkg.packageName}@${validationMetadata.version}`,
+        packageInfo
+      )
+      let metadata
+      if (!manifest.dist || !manifest.dist.attestations) {
+        metadata = await verifier.verifyAttestations(manifest, [], null)
+      } else {
+        const [keys, attestations] = await Promise.all([
+          this.registryClient.getRegistryKeys(pkg.packageName),
+          this.registryClient.getAttestations(pkg.packageName, manifest)
+        ])
+        metadata = await verifier.verifyAttestations(manifest, keys, attestations)
+      }
+
+      if (!metadata || !metadata._attestations) {
+        this.throwIfProvenanceRegression(validationMetadata)
+        throw new Warning('the package was published without any attestations')
+      }
+      return metadata._attestations
+    } catch (error) {
+      if (error instanceof NotEvaluated || error instanceof RegistryError) {
+        throw error
+      }
+      if (error.code === 'EATTESTATIONVERIFY' && error.message.includes('malformed checkpoint')) {
+        return []
+      }
+      if (
+        error instanceof Error &&
+        error.message === 'Unable to find version or dist-tag for package'
+      ) {
+        throw error
+      }
+      if (
+        error instanceof Warning &&
+        error.message === 'the package was published without any attestations'
+      ) {
+        throw error
+      }
+      if (shouldConsiderProvenanceRegression(error)) {
+        this.throwIfProvenanceRegression(validationMetadata)
+      }
+      if (error.message.includes('Package has no attestations to verify')) {
+        throw new Warning(
+          'Unable to verify provenance: the package was published without any attestations'
         )
-        throw new Warning(`Unable to verify provenance`)
-      })
-  }
+      }
 
-  fetchRegistryKeys() {
-    const registryHost = 'https://registry.npmjs.org'
-    const registryKeysEndpoint = '/-/npm/v1/keys'
-
-    const registryKeysUrl = `${registryHost}${registryKeysEndpoint}`
-    return fetch(registryKeysUrl)
-      .then((response) => {
-        return response.json()
-      })
-      .then((response) => {
-        const registryKeys = response.keys
-
-        return registryKeys.map((key) => ({
-          ...key,
-          pemkey: `-----BEGIN PUBLIC KEY-----\n${key.key}\n-----END PUBLIC KEY-----`
-        }))
-      })
-      .then((keys) => {
-        return keys
-      })
-      .catch((error) => {
-        throw new Warning(`Error fetching registry keys: ${error.message}`)
-      })
+      this.debug(
+        '\nUnable to verify provenance for package %s@%s: %s',
+        validationMetadata.name,
+        validationMetadata.version,
+        error.message
+      )
+      throw new Warning('Unable to verify provenance')
+    }
   }
 }
 

package/lib/marshalls/signatures.marshall.js

@@ -3,12 +3,12 @@
 const BaseMarshall = require('./baseMarshall')
 const Warning = require('../helpers/warning')
 const NpmRegistry = require('../helpers/npmRegistry')
+const NotEvaluated = require('../helpers/notEvaluated')
+const { RegistryError } = require('../helpers/registryErrors')
 const { marshallCategories } = require('./constants')
 
 const MARSHALL_NAME = 'signatures'
 
-let registryKeysCache = null
-
 class Marshall extends BaseMarshall {
   constructor(options) {
     super(options)
@@ -20,83 +20,44 @@ class Marshall extends BaseMarshall {
     return 'Verifying registry signatures for package'
   }
 
-  validate(pkg) {
-    const npmRegistry = new NpmRegistry({
-      registry: 'https://registry.npmjs.org'
-    })
-
-    return this.packageRepoUtils
-      .getPackageInfo(pkg.packageName)
-      .then(async (packageInfo) => {
-        // Resolve version range to specific version
-        const resolvedVersion = await this.resolvePackageVersion(
-          pkg.packageName,
-          pkg.packageVersion,
-          packageInfo
-        )
+  async validate(pkg) {
+    const verifier = new NpmRegistry()
 
-        if (!resolvedVersion) {
-          throw new Error(
-            `Unable to resolve version ${pkg.packageVersion} for package ${pkg.packageName}`
-          )
-        }
+    try {
+      const packageInfo = await this.packageRepoUtils.getPackageInfo(pkg.packageName)
+      const resolvedVersion = await this.resolvePackageVersion(
+        pkg.packageName,
+        pkg.packageVersion,
+        packageInfo
+      )
 
-        return { packageInfo, resolvedVersion }
-      })
-      .then(({ resolvedVersion }) => {
-        return this.fetchRegistryKeys().then((keys) => {
-          return npmRegistry
-            .getManifest(`${pkg.packageName}@${resolvedVersion}`)
-            .then((manifest) => npmRegistry.verifySignatures(manifest, keys))
-        })
-      })
-      .then((metadata) => {
-        return metadata
-      })
-      .catch((error) => {
-        // Handle specific error cases
-        if (
-          error.message &&
-          error.message.includes('but the corresponding public key has expired')
-        ) {
-          // if the error is about an expired key, we throw a warning
-          // instead of an error, so that the process can continue
-          throw new Warning(`Package is signed with an expired key`)
-        }
-
-        throw new Warning(`Unable to verify package signature on registry: ${error.message}`)
-      })
-  }
+      if (!resolvedVersion) {
+        throw new Error(
+          `Unable to resolve version ${pkg.packageVersion} for package ${pkg.packageName}`
+        )
+      }
 
-  fetchRegistryKeys() {
-    if (registryKeysCache) {
-      return Promise.resolve(registryKeysCache)
+      const manifest = await this.registryClient.getManifest(
+        `${pkg.packageName}@${resolvedVersion}`,
+        packageInfo
+      )
+      if (!manifest.dist || !manifest.dist.signatures) {
+        return await verifier.verifySignatures(manifest, [])
+      }
+      const keys = await this.registryClient.getRegistryKeys(pkg.packageName)
+      return await verifier.verifySignatures(manifest, keys)
+    } catch (error) {
+      if (error instanceof NotEvaluated || error instanceof RegistryError) {
+        throw error
+      }
+      if (
+        error.message &&
+        error.message.includes('but the corresponding public key has expired')
+      ) {
+        throw new Warning('Package is signed with an expired key')
+      }
+      throw new Warning(`Unable to verify package signature on registry: ${error.message}`)
     }
-
-    const registryHost = 'https://registry.npmjs.org'
-    const registryKeysEndpoint = '/-/npm/v1/keys'
-
-    const registryKeysUrl = `${registryHost}${registryKeysEndpoint}`
-    return fetch(registryKeysUrl)
-      .then((response) => {
-        return response.json()
-      })
-      .then((response) => {
-        const registryKeys = response.keys
-
-        return registryKeys.map((key) => ({
-          ...key,
-          pemkey: `-----BEGIN PUBLIC KEY-----\n${key.key}\n-----END PUBLIC KEY-----`
-        }))
-      })
-      .then((keys) => {
-        // save it in the cached singleton object
-        registryKeysCache = keys
-        return keys
-      })
-      .catch((error) => {
-        throw new Warning(`Error fetching registry keys: ${error.message}`)
-      })
   }
 }
 

package/lib/marshalls/typosquatting.marshall.js

@@ -6,6 +6,7 @@ const { marshallCategories } = require('./constants')
 const path = require('path')
 const { levenshteinDistance } = require('../helpers/levenshteinDistance')
 const topPackagesRawJSON = require(path.join(__dirname, '../../data/top-packages.json'))
+const topPackages = new Set(topPackagesRawJSON)
 
 const MARSHALL_NAME = 'typosquatting'
 
@@ -29,13 +30,13 @@ class Marshall extends BaseMarshall {
         return resolve([])
       }
 
-      for (const popularPackageNameInRepository of topPackagesRawJSON) {
-        // If the package to be installed is itself found within the Top Packages dataset
-        // then we don't report on it
-        if (pkg.packageName === popularPackageNameInRepository) {
-          return resolve([])
-        }
+      // If the package to be installed is itself found within the Top Packages dataset
+      // then we don't report on it
+      if (topPackages.has(pkg.packageName)) {
+        return resolve([])
+      }
 
+      for (const popularPackageNameInRepository of topPackagesRawJSON) {
         editDistance = levenshteinDistance(pkg.packageName, popularPackageNameInRepository)
 
         if (editDistance > 0 && editDistance < 3) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "3.19.6",
+  "version": "3.21.0",
   "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",
@@ -14,13 +14,14 @@
     "build": "node scripts/build.js",
     "test:watch": "jest --watch",
     "format": "prettier --config .prettierrc.js --write \"**/*.js\"",
-    "semantic-release": "npx semantic-release",
+    "semantic-release": "semantic-release",
     "#postinstall": "node scripts/postinstall.js",
     "#preuninstall": "node scripts/preuninstall.js",
     "prepare": "husky || true"
   },
   "engines": {
-    "node": ">=20.13.0"
+    "npm": ">=11.10.0",
+    "node": ">=24.0.0"
   },
   "files": [
     "bin/",
@@ -42,7 +43,9 @@
     "access": "public"
   },
   "dependencies": {
+    "@npmcli/config": "^10.10.0",
     "npm-package-arg": "^13.0.2",
+    "npm-registry-fetch": "^19.1.1",
     "semver": "^7.7.4",
     "sigstore": "^4.1.0",
     "ssri": "^13.0.1"
@@ -57,7 +60,8 @@
     "jest": "^30.3.0",
     "lint-staged": "^16.4.0",
     "lockfile-lint": "^5.0.0",
-    "prettier": "^3.6.2"
+    "prettier": "^3.6.2",
+    "semantic-release": "25.0.3"
   },
   "lint-staged": {
     "**/*.js": [

package/scripts/build.js

@@ -3,15 +3,46 @@
 const fs = require('fs/promises')
 const path = require('path')
 
-const TOP_PACKAGES_ASSET_URL =
-  'https://github.com/lirantal/npm-rank/releases/download/latest/list-package-names.json'
-
 const TOP_PACKAGES_FILE_PATH = path.join(__dirname, '../data/top-packages.json')
+const NPM_HIGH_IMPACT_TOP_PACKAGES_URL = 'https://unpkg.com/npm-high-impact@1.13.0/lib/top.js'
+const TOP_PACKAGES_EXPORT_PATTERN = /^export const top = \[\n([\s\S]*)\n\]\n?$/
+const TOP_PACKAGE_NAME_PATTERN = /^[ ]{2}'([^'\\]+)',?$/
+
+function parseTopPackages(source) {
+  const topPackagesExport = source.match(TOP_PACKAGES_EXPORT_PATTERN)
+
+  if (!topPackagesExport) {
+    throw new Error('Unexpected npm-high-impact top packages export format')
+  }
+
+  const topPackages = topPackagesExport[1].split('\n').map((line) => {
+    const packageName = line.match(TOP_PACKAGE_NAME_PATTERN)
+
+    if (!packageName) {
+      throw new Error(`Unexpected npm-high-impact package entry: ${line}`)
+    }
+
+    return packageName[1]
+  })
+
+  if (topPackages.length === 0) {
+    throw new Error('npm-high-impact top packages export is empty')
+  }
+
+  return [...new Set(topPackages)]
+}
 
 async function downloadTopPackages() {
-  const response = await fetch(TOP_PACKAGES_ASSET_URL)
-  const data = await response.json()
-  return data
+  // Keep this pinned to a published npm-high-impact artifact for reproducible builds.
+  const response = await fetch(NPM_HIGH_IMPACT_TOP_PACKAGES_URL)
+
+  if (!response.ok) {
+    throw new Error(
+      `Failed to download npm-high-impact top packages: ${response.status} ${response.statusText}`
+    )
+  }
+
+  return parseTopPackages(await response.text())
 }
 
 async function saveTopPackagesToFile() {