npq 3.21.2 → 3.21.4

package/README.md

@@ -146,7 +146,7 @@ Note: `npq` by default will offload all commands and their arguments to the `npm
 | scripts | Will show a warning if a package has a pre/post install script which could potentially be malicious
 | snyk | Will show a warning if a package has been found with vulnerabilities in Snyk's database | For Snyk to work you need to either have the `snyk` npm package installed with a valid API token, or make the token available in the `SNYK_TOKEN` environment variable, and npq will use it
 | license | Will show a warning if a package has been found without a license field | Checks the latest version for a license
-| expired domains | Will show a warning if a package has been found with one of its maintainers having an email address that includes an expired domain | Checks a dependency version for a maintainer with an expired domain
+| expired domains | Normalizes and checks complete maintainer email hosts, warning only when a simple two-label domain does not resolve but its public top-level domain does | Multipart and otherwise inconclusive DNS failures are reported as not evaluated; non-resolution is not proof that a domain is expired or available
 | signatures | Will compare the package's signature as it shows on the registry's packument with signing keys published by the selected registry | Reports `not evaluated` if the selected registry does not expose signing keys
 | provenance | Will verify the package's attestations of provenance metadata for the published package, and **error** on [provenance regression](docs/feature/provenance.md) (an older semver had registry provenance metadata but the version you install does not) | Reports `not evaluated` if the selected registry does not expose signing keys or attestations
 | version-maturity | Will show a warning if the specific version being installed was published less than 7 days ago | Helps identify recently published versions that may not have been reviewed by the community yet

package/lib/helpers/maintainerDomain.js

@@ -0,0 +1,77 @@
+'use strict'
+
+const { isIP } = require('node:net')
+const { domainToASCII } = require('node:url')
+
+const SPECIAL_USE_SUFFIXES = new Set([
+  'alt',
+  'corp',
+  'example',
+  'home',
+  'internal',
+  'invalid',
+  'local',
+  'localhost',
+  'mail',
+  'onion',
+  'test'
+])
+const RESERVED_HOSTS = new Set([
+  'example.com',
+  'example.net',
+  'example.org',
+  'home.arpa',
+  'in-addr.arpa',
+  'ip6.arpa'
+])
+
+function hasReservedSuffix(hostname, suffixes) {
+  return [...suffixes].some((suffix) => hostname === suffix || hostname.endsWith(`.${suffix}`))
+}
+
+function normalizeMaintainerDomain(maintainerEmail) {
+  const atIndex = typeof maintainerEmail === 'string' ? maintainerEmail.lastIndexOf('@') : -1
+  const hasOneAtSign = atIndex > 0 && maintainerEmail.indexOf('@') === atIndex
+  const emailDomain = atIndex > 0 ? maintainerEmail.slice(atIndex + 1).trim() : ''
+
+  if (!hasOneAtSign || !emailDomain || /\s/.test(emailDomain)) {
+    return null
+  }
+
+  const hostname = emailDomain.replace(/\.$/, '').toLowerCase()
+  const bracketedIp = hostname.match(/^\[(.*)\]$/)
+  if (isIP(bracketedIp ? bracketedIp[1] : hostname)) {
+    return null
+  }
+
+  const asciiHostname = domainToASCII(hostname).toLowerCase()
+  const labels = asciiHostname.split('.')
+  const labelsAreValid = labels.every(
+    (label) =>
+      label.length > 0 &&
+      label.length <= 63 &&
+      /^[a-z0-9-]+$/.test(label) &&
+      !label.startsWith('-') &&
+      !label.endsWith('-')
+  )
+
+  if (
+    !asciiHostname ||
+    isIP(asciiHostname) ||
+    asciiHostname.length > 253 ||
+    labels.length < 2 ||
+    !labelsAreValid ||
+    hasReservedSuffix(asciiHostname, SPECIAL_USE_SUFFIXES) ||
+    hasReservedSuffix(asciiHostname, RESERVED_HOSTS)
+  ) {
+    return null
+  }
+
+  return asciiHostname
+}
+
+function isSimpleMaintainerDomain(domain) {
+  return domain.split('.').length === 2
+}
+
+module.exports = { isSimpleMaintainerDomain, normalizeMaintainerDomain }

package/lib/marshalls/expiredDomains.marshall.js

@@ -3,6 +3,11 @@
 const BaseMarshall = require('./baseMarshall')
 const { marshallCategories } = require('./constants')
 const NotEvaluated = require('../helpers/notEvaluated')
+const Warning = require('../helpers/warning')
+const {
+  isSimpleMaintainerDomain,
+  normalizeMaintainerDomain
+} = require('../helpers/maintainerDomain')
 const { Resolver } = require('dns/promises')
 
 const dns = new Resolver()
@@ -32,44 +37,104 @@ class Marshall extends BaseMarshall {
       throw new NotEvaluated('no maintainers information available for the package')
     }
 
-    const emailDomains = []
+    const emailDomains = new Map()
     let invalidMaintainers = 0
     for (const maintainerInfo of maintainersAccounts) {
-      const maintainerEmail = maintainerInfo && maintainerInfo.email
-      const atIndex = typeof maintainerEmail === 'string' ? maintainerEmail.lastIndexOf('@') : -1
-      const emailDomain = atIndex > 0 ? maintainerEmail.slice(atIndex + 1).trim() : ''
+      const emailDomain = normalizeMaintainerDomain(maintainerInfo && maintainerInfo.email)
 
-      if (!emailDomain || emailDomain.includes('@') || /\s/.test(emailDomain)) {
+      if (!emailDomain) {
         invalidMaintainers += 1
         continue
       }
 
-      emailDomains.push(emailDomain)
+      emailDomains.set(emailDomain, (emailDomains.get(emailDomain) || 0) + 1)
     }
 
-    if (emailDomains.length === 0) {
+    if (emailDomains.size === 0) {
       throw new NotEvaluated('no valid maintainer email domains are available for the package')
     }
 
-    let resolutionResults
-    try {
-      resolutionResults = await Promise.all(
-        emailDomains.map((emailDomain) => this.dnsResolver.resolve(emailDomain, 'NS'))
+    const domains = [...emailDomains.keys()].sort()
+    const resolutionResults = await Promise.allSettled(
+      domains.map((emailDomain) => this.dnsResolver.resolve(emailDomain, 'NS'))
+    )
+    const simpleMissingDomains = []
+    const incompleteDomains = []
+
+    resolutionResults.forEach((result, index) => {
+      if (result.status === 'fulfilled') {
+        return
+      }
+
+      const domain = domains[index]
+      const errorCode = result.reason && result.reason.code
+      this.debug(
+        '\nUnable to resolve maintainer email domain %s with code %s',
+        domain,
+        errorCode || '<unknown>'
       )
-    } catch (error) {
-      const emailHostname = error.hostname ? error.hostname : '<unknown>'
-      this.debug('\nDetected error resolving domain for maintainer e-mail: %s', emailHostname)
-      throw new Error(
-        'Detected expired domain can be abused for account takeover: ' + emailHostname
+
+      if (errorCode === 'ENOTFOUND' && isSimpleMaintainerDomain(domain)) {
+        simpleMissingDomains.push(domain)
+      } else {
+        incompleteDomains.push(domain)
+      }
+    })
+
+    const topLevelDomains = [
+      ...new Set(simpleMissingDomains.map((domain) => domain.split('.')[1]))
+    ].sort()
+    const topLevelResults = await Promise.allSettled(
+      topLevelDomains.map((domain) => this.dnsResolver.resolve(domain, 'NS'))
+    )
+    const publicTopLevelDomains = new Set()
+
+    topLevelResults.forEach((result, index) => {
+      const domain = topLevelDomains[index]
+      if (result.status === 'fulfilled') {
+        publicTopLevelDomains.add(domain)
+        return
+      }
+
+      this.debug(
+        '\nUnable to verify public top-level domain %s with code %s',
+        domain,
+        (result.reason && result.reason.code) || '<unknown>'
       )
+    })
+
+    const suspectedDomains = simpleMissingDomains.filter((domain) => {
+      const isPublic = publicTopLevelDomains.has(domain.split('.')[1])
+      if (!isPublic) {
+        incompleteDomains.push(domain)
+      }
+      return isPublic
+    })
+
+    const incompleteCount =
+      invalidMaintainers +
+      incompleteDomains.reduce((count, domain) => count + emailDomains.get(domain), 0)
+    if (suspectedDomains.length > 0) {
+      const domainNoun = suspectedDomains.length === 1 ? 'domain' : 'domains'
+      const resolveVerb = suspectedDomains.length === 1 ? 'does' : 'do'
+      let message = `Maintainer ${domainNoun} ${suspectedDomains.join(', ')} ${resolveVerb} not resolve in public DNS and may warrant investigation.`
+
+      if (incompleteCount > 0) {
+        const recordNoun = incompleteCount === 1 ? 'record' : 'records'
+        message += ` ${incompleteCount} other maintainer ${recordNoun} could not be evaluated.`
+      }
+
+      throw new Warning(message)
     }
 
-    if (invalidMaintainers > 0) {
-      const noun = invalidMaintainers === 1 ? 'address is' : 'addresses are'
-      throw new NotEvaluated(`${invalidMaintainers} maintainer email ${noun} missing or malformed`)
+    if (incompleteCount > 0) {
+      const recordNoun = incompleteCount === 1 ? 'record' : 'records'
+      throw new NotEvaluated(
+        `${incompleteCount} maintainer ${recordNoun} could not be evaluated because DNS or email data was incomplete`
+      )
     }
 
-    return resolutionResults
+    return resolutionResults.map((result) => result.value)
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "3.21.2",
+  "version": "3.21.4",
   "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",