npq 3.23.0 → 3.23.2

package/lib/marshalls/expiredDomains.marshall.js

@@ -15,6 +15,19 @@ const dns = new Resolver()
 dns.setServers(['1.1.1.1', '8.8.8.8'])
 const MARSHALL_NAME = 'maintainers_expired_emails'
 
+function stripTerminalControlCharacters(value) {
+  if (typeof value !== 'string') {
+    return ''
+  }
+
+  return [...value]
+    .filter((character) => {
+      const codePoint = character.codePointAt(0)
+      return codePoint >= 0x20 && (codePoint < 0x7f || codePoint > 0x9f)
+    })
+    .join('')
+}
+
 class Marshall extends BaseMarshall {
   constructor(options) {
     super(options)
@@ -30,16 +43,21 @@ class Marshall extends BaseMarshall {
 
   async validate(pkg) {
     const data = await this.packageRepoUtils.getPackageInfo(pkg.packageName)
-    const lastVersionData =
-      data.versions && data['dist-tags'] && data.versions[data['dist-tags'].latest]
+    const packageVersion = await this.resolvePackageVersion(
+      pkg.packageName,
+      pkg.packageVersion || 'latest',
+      data
+    )
+    const versionData = packageVersion && data.versions && data.versions[packageVersion]
 
-    const maintainersAccounts = lastVersionData && lastVersionData.maintainers
+    const maintainersAccounts = versionData && versionData.maintainers
 
     if (!Array.isArray(maintainersAccounts) || maintainersAccounts.length === 0) {
       throw new NotEvaluated('no maintainers information available for the package')
     }
 
     const emailDomains = new Map()
+    const maintainersByDomain = new Map()
     let invalidMaintainers = 0
     for (const maintainerInfo of maintainersAccounts) {
       const emailDomain = normalizeMaintainerDomain(maintainerInfo && maintainerInfo.email)
@@ -50,6 +68,9 @@ class Marshall extends BaseMarshall {
       }
 
       emailDomains.set(emailDomain, (emailDomains.get(emailDomain) || 0) + 1)
+      const domainMaintainers = maintainersByDomain.get(emailDomain) || []
+      domainMaintainers.push(maintainerInfo)
+      maintainersByDomain.set(emailDomain, domainMaintainers)
     }
 
     if (emailDomains.size === 0) {
@@ -138,10 +159,26 @@ class Marshall extends BaseMarshall {
       const domainNoun = corroboratedDomains.length === 1 ? 'domain' : 'domains'
       const resolveVerb = corroboratedDomains.length === 1 ? 'does' : 'do'
       let message = `Maintainer ${domainNoun} ${corroboratedDomains.join(', ')} ${resolveVerb} not resolve in public DNS, and RDAP found no active registration; account takeover may be possible.`
+      const affectedMaintainers = corroboratedDomains
+        .map((domain) => {
+          const identities = maintainersByDomain
+            .get(domain)
+            .map((maintainer) => {
+              const name = stripTerminalControlCharacters(maintainer.name).trim()
+              const email = stripTerminalControlCharacters(maintainer.email)
+              return name.length > 0 ? `${name} <${email}>` : email
+            })
+            .join(', ')
+
+          return `- ${domain}: ${identities}`
+        })
+        .join('\n')
+
+      message += `\n\nAffected maintainers:\n${affectedMaintainers}`
 
       if (incompleteCount > 0) {
         const recordNoun = incompleteCount === 1 ? 'record' : 'records'
-        message += ` ${incompleteCount} other maintainer ${recordNoun} could not be evaluated.`
+        message += `\n\n${incompleteCount} other maintainer ${recordNoun} could not be evaluated.`
       }
 
       throw new Warning(message)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "3.23.0",
+  "version": "3.23.2",
   "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",