npq 3.21.2 → 3.21.3

package/README.md

@@ -146,7 +146,7 @@ Note: `npq` by default will offload all commands and their arguments to the `npm
 | scripts | Will show a warning if a package has a pre/post install script which could potentially be malicious
 | snyk | Will show a warning if a package has been found with vulnerabilities in Snyk's database | For Snyk to work you need to either have the `snyk` npm package installed with a valid API token, or make the token available in the `SNYK_TOKEN` environment variable, and npq will use it
 | license | Will show a warning if a package has been found without a license field | Checks the latest version for a license
-| expired domains | Will show a warning if a package has been found with one of its maintainers having an email address that includes an expired domain | Checks a dependency version for a maintainer with an expired domain
+| expired domains | Will warn when a maintainer email domain does not resolve in public DNS; inconclusive DNS failures are reported as not evaluated | DNS non-resolution is a risk signal, not proof that the domain is expired or available
 | signatures | Will compare the package's signature as it shows on the registry's packument with signing keys published by the selected registry | Reports `not evaluated` if the selected registry does not expose signing keys
 | provenance | Will verify the package's attestations of provenance metadata for the published package, and **error** on [provenance regression](docs/feature/provenance.md) (an older semver had registry provenance metadata but the version you install does not) | Reports `not evaluated` if the selected registry does not expose signing keys or attestations
 | version-maturity | Will show a warning if the specific version being installed was published less than 7 days ago | Helps identify recently published versions that may not have been reviewed by the community yet

package/lib/marshalls/expiredDomains.marshall.js

@@ -3,6 +3,7 @@
 const BaseMarshall = require('./baseMarshall')
 const { marshallCategories } = require('./constants')
 const NotEvaluated = require('../helpers/notEvaluated')
+const Warning = require('../helpers/warning')
 const { Resolver } = require('dns/promises')
 
 const dns = new Resolver()
@@ -32,44 +33,82 @@ class Marshall extends BaseMarshall {
       throw new NotEvaluated('no maintainers information available for the package')
     }
 
-    const emailDomains = []
+    const emailDomains = new Map()
     let invalidMaintainers = 0
     for (const maintainerInfo of maintainersAccounts) {
       const maintainerEmail = maintainerInfo && maintainerInfo.email
       const atIndex = typeof maintainerEmail === 'string' ? maintainerEmail.lastIndexOf('@') : -1
-      const emailDomain = atIndex > 0 ? maintainerEmail.slice(atIndex + 1).trim() : ''
+      const emailDomain =
+        atIndex > 0
+          ? maintainerEmail
+              .slice(atIndex + 1)
+              .trim()
+              .toLowerCase()
+          : ''
 
       if (!emailDomain || emailDomain.includes('@') || /\s/.test(emailDomain)) {
         invalidMaintainers += 1
         continue
       }
 
-      emailDomains.push(emailDomain)
+      emailDomains.set(emailDomain, (emailDomains.get(emailDomain) || 0) + 1)
     }
 
-    if (emailDomains.length === 0) {
+    if (emailDomains.size === 0) {
       throw new NotEvaluated('no valid maintainer email domains are available for the package')
     }
 
-    let resolutionResults
-    try {
-      resolutionResults = await Promise.all(
-        emailDomains.map((emailDomain) => this.dnsResolver.resolve(emailDomain, 'NS'))
-      )
-    } catch (error) {
-      const emailHostname = error.hostname ? error.hostname : '<unknown>'
-      this.debug('\nDetected error resolving domain for maintainer e-mail: %s', emailHostname)
-      throw new Error(
-        'Detected expired domain can be abused for account takeover: ' + emailHostname
+    const domains = [...emailDomains.keys()].sort()
+    const resolutionResults = await Promise.allSettled(
+      domains.map((emailDomain) => this.dnsResolver.resolve(emailDomain, 'NS'))
+    )
+    const suspectedDomains = []
+    const incompleteDomains = []
+
+    resolutionResults.forEach((result, index) => {
+      if (result.status === 'fulfilled') {
+        return
+      }
+
+      const domain = domains[index]
+      const errorCode = result.reason && result.reason.code
+      this.debug(
+        '\nUnable to resolve maintainer email domain %s with code %s',
+        domain,
+        errorCode || '<unknown>'
       )
+
+      if (errorCode === 'ENOTFOUND') {
+        suspectedDomains.push(domain)
+      } else {
+        incompleteDomains.push(domain)
+      }
+    })
+
+    const incompleteCount =
+      invalidMaintainers +
+      incompleteDomains.reduce((count, domain) => count + emailDomains.get(domain), 0)
+    if (suspectedDomains.length > 0) {
+      const domainNoun = suspectedDomains.length === 1 ? 'domain' : 'domains'
+      const resolveVerb = suspectedDomains.length === 1 ? 'does' : 'do'
+      let message = `Maintainer ${domainNoun} ${suspectedDomains.join(', ')} ${resolveVerb} not resolve in public DNS and may warrant investigation.`
+
+      if (incompleteCount > 0) {
+        const recordNoun = incompleteCount === 1 ? 'record' : 'records'
+        message += ` ${incompleteCount} other maintainer ${recordNoun} could not be evaluated.`
+      }
+
+      throw new Warning(message)
     }
 
-    if (invalidMaintainers > 0) {
-      const noun = invalidMaintainers === 1 ? 'address is' : 'addresses are'
-      throw new NotEvaluated(`${invalidMaintainers} maintainer email ${noun} missing or malformed`)
+    if (incompleteCount > 0) {
+      const recordNoun = incompleteCount === 1 ? 'record' : 'records'
+      throw new NotEvaluated(
+        `${incompleteCount} maintainer ${recordNoun} could not be evaluated because DNS or email data was incomplete`
+      )
     }
 
-    return resolutionResults
+    return resolutionResults.map((result) => result.value)
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "3.21.2",
+  "version": "3.21.3",
   "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",