npq 3.21.3 → 3.21.4

package/README.md

@@ -146,7 +146,7 @@ Note: `npq` by default will offload all commands and their arguments to the `npm
 | scripts | Will show a warning if a package has a pre/post install script which could potentially be malicious
 | snyk | Will show a warning if a package has been found with vulnerabilities in Snyk's database | For Snyk to work you need to either have the `snyk` npm package installed with a valid API token, or make the token available in the `SNYK_TOKEN` environment variable, and npq will use it
 | license | Will show a warning if a package has been found without a license field | Checks the latest version for a license
-| expired domains | Will warn when a maintainer email domain does not resolve in public DNS; inconclusive DNS failures are reported as not evaluated | DNS non-resolution is a risk signal, not proof that the domain is expired or available
+| expired domains | Normalizes and checks complete maintainer email hosts, warning only when a simple two-label domain does not resolve but its public top-level domain does | Multipart and otherwise inconclusive DNS failures are reported as not evaluated; non-resolution is not proof that a domain is expired or available
 | signatures | Will compare the package's signature as it shows on the registry's packument with signing keys published by the selected registry | Reports `not evaluated` if the selected registry does not expose signing keys
 | provenance | Will verify the package's attestations of provenance metadata for the published package, and **error** on [provenance regression](docs/feature/provenance.md) (an older semver had registry provenance metadata but the version you install does not) | Reports `not evaluated` if the selected registry does not expose signing keys or attestations
 | version-maturity | Will show a warning if the specific version being installed was published less than 7 days ago | Helps identify recently published versions that may not have been reviewed by the community yet

package/lib/helpers/maintainerDomain.js

@@ -0,0 +1,77 @@
+'use strict'
+
+const { isIP } = require('node:net')
+const { domainToASCII } = require('node:url')
+
+const SPECIAL_USE_SUFFIXES = new Set([
+  'alt',
+  'corp',
+  'example',
+  'home',
+  'internal',
+  'invalid',
+  'local',
+  'localhost',
+  'mail',
+  'onion',
+  'test'
+])
+const RESERVED_HOSTS = new Set([
+  'example.com',
+  'example.net',
+  'example.org',
+  'home.arpa',
+  'in-addr.arpa',
+  'ip6.arpa'
+])
+
+function hasReservedSuffix(hostname, suffixes) {
+  return [...suffixes].some((suffix) => hostname === suffix || hostname.endsWith(`.${suffix}`))
+}
+
+function normalizeMaintainerDomain(maintainerEmail) {
+  const atIndex = typeof maintainerEmail === 'string' ? maintainerEmail.lastIndexOf('@') : -1
+  const hasOneAtSign = atIndex > 0 && maintainerEmail.indexOf('@') === atIndex
+  const emailDomain = atIndex > 0 ? maintainerEmail.slice(atIndex + 1).trim() : ''
+
+  if (!hasOneAtSign || !emailDomain || /\s/.test(emailDomain)) {
+    return null
+  }
+
+  const hostname = emailDomain.replace(/\.$/, '').toLowerCase()
+  const bracketedIp = hostname.match(/^\[(.*)\]$/)
+  if (isIP(bracketedIp ? bracketedIp[1] : hostname)) {
+    return null
+  }
+
+  const asciiHostname = domainToASCII(hostname).toLowerCase()
+  const labels = asciiHostname.split('.')
+  const labelsAreValid = labels.every(
+    (label) =>
+      label.length > 0 &&
+      label.length <= 63 &&
+      /^[a-z0-9-]+$/.test(label) &&
+      !label.startsWith('-') &&
+      !label.endsWith('-')
+  )
+
+  if (
+    !asciiHostname ||
+    isIP(asciiHostname) ||
+    asciiHostname.length > 253 ||
+    labels.length < 2 ||
+    !labelsAreValid ||
+    hasReservedSuffix(asciiHostname, SPECIAL_USE_SUFFIXES) ||
+    hasReservedSuffix(asciiHostname, RESERVED_HOSTS)
+  ) {
+    return null
+  }
+
+  return asciiHostname
+}
+
+function isSimpleMaintainerDomain(domain) {
+  return domain.split('.').length === 2
+}
+
+module.exports = { isSimpleMaintainerDomain, normalizeMaintainerDomain }

package/lib/marshalls/expiredDomains.marshall.js

@@ -4,6 +4,10 @@ const BaseMarshall = require('./baseMarshall')
 const { marshallCategories } = require('./constants')
 const NotEvaluated = require('../helpers/notEvaluated')
 const Warning = require('../helpers/warning')
+const {
+  isSimpleMaintainerDomain,
+  normalizeMaintainerDomain
+} = require('../helpers/maintainerDomain')
 const { Resolver } = require('dns/promises')
 
 const dns = new Resolver()
@@ -36,17 +40,9 @@ class Marshall extends BaseMarshall {
     const emailDomains = new Map()
     let invalidMaintainers = 0
     for (const maintainerInfo of maintainersAccounts) {
-      const maintainerEmail = maintainerInfo && maintainerInfo.email
-      const atIndex = typeof maintainerEmail === 'string' ? maintainerEmail.lastIndexOf('@') : -1
-      const emailDomain =
-        atIndex > 0
-          ? maintainerEmail
-              .slice(atIndex + 1)
-              .trim()
-              .toLowerCase()
-          : ''
-
-      if (!emailDomain || emailDomain.includes('@') || /\s/.test(emailDomain)) {
+      const emailDomain = normalizeMaintainerDomain(maintainerInfo && maintainerInfo.email)
+
+      if (!emailDomain) {
         invalidMaintainers += 1
         continue
       }
@@ -62,7 +58,7 @@ class Marshall extends BaseMarshall {
     const resolutionResults = await Promise.allSettled(
       domains.map((emailDomain) => this.dnsResolver.resolve(emailDomain, 'NS'))
     )
-    const suspectedDomains = []
+    const simpleMissingDomains = []
     const incompleteDomains = []
 
     resolutionResults.forEach((result, index) => {
@@ -78,13 +74,43 @@ class Marshall extends BaseMarshall {
         errorCode || '<unknown>'
       )
 
-      if (errorCode === 'ENOTFOUND') {
-        suspectedDomains.push(domain)
+      if (errorCode === 'ENOTFOUND' && isSimpleMaintainerDomain(domain)) {
+        simpleMissingDomains.push(domain)
       } else {
         incompleteDomains.push(domain)
       }
     })
 
+    const topLevelDomains = [
+      ...new Set(simpleMissingDomains.map((domain) => domain.split('.')[1]))
+    ].sort()
+    const topLevelResults = await Promise.allSettled(
+      topLevelDomains.map((domain) => this.dnsResolver.resolve(domain, 'NS'))
+    )
+    const publicTopLevelDomains = new Set()
+
+    topLevelResults.forEach((result, index) => {
+      const domain = topLevelDomains[index]
+      if (result.status === 'fulfilled') {
+        publicTopLevelDomains.add(domain)
+        return
+      }
+
+      this.debug(
+        '\nUnable to verify public top-level domain %s with code %s',
+        domain,
+        (result.reason && result.reason.code) || '<unknown>'
+      )
+    })
+
+    const suspectedDomains = simpleMissingDomains.filter((domain) => {
+      const isPublic = publicTopLevelDomains.has(domain.split('.')[1])
+      if (!isPublic) {
+        incompleteDomains.push(domain)
+      }
+      return isPublic
+    })
+
     const incompleteCount =
       invalidMaintainers +
       incompleteDomains.reduce((count, domain) => count + emailDomains.get(domain), 0)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "3.21.3",
+  "version": "3.21.4",
   "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",