npq 3.23.3 → 3.25.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +17 -0
- package/bin/npq-hero.js +116 -107
- package/bin/npq.js +151 -139
- package/lib/cli.js +26 -8
- package/lib/helpers/auditFailure.js +25 -0
- package/lib/helpers/codingAgentEnvironment.js +23 -0
- package/lib/helpers/jsonOutput.js +24 -0
- package/lib/helpers/jsonPackageSpec.js +29 -0
- package/lib/helpers/jsonReport.js +76 -0
- package/lib/helpers/registryClient.js +2 -7
- package/lib/helpers/registryConfig.js +2 -8
- package/lib/helpers/reportResults.js +5 -16
- package/lib/helpers/versionAge.js +2 -9
- package/lib/jsonAudit.js +71 -0
- package/lib/jsonCli.js +61 -0
- package/lib/marshall.js +11 -6
- package/lib/marshalls/baseMarshall.js +1 -1
- package/lib/marshalls/index.js +44 -7
- package/lib/marshalls/signatures.marshall.js +1 -4
- package/package.json +3 -1
- package/schema/npq-output-v1.schema.json +86 -0
|
@@ -50,10 +50,7 @@ class Marshall extends BaseMarshall {
|
|
|
50
50
|
if (error instanceof NotEvaluated || error instanceof RegistryError) {
|
|
51
51
|
throw error
|
|
52
52
|
}
|
|
53
|
-
if (
|
|
54
|
-
error.message &&
|
|
55
|
-
error.message.includes('but the corresponding public key has expired')
|
|
56
|
-
) {
|
|
53
|
+
if (error.message && error.message.includes('but the corresponding public key has expired')) {
|
|
57
54
|
throw new Warning('Package is signed with an expired key')
|
|
58
55
|
}
|
|
59
56
|
throw new Warning(`Unable to verify package signature on registry: ${error.message}`)
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "npq",
|
|
3
|
-
"version": "3.
|
|
3
|
+
"version": "3.25.0",
|
|
4
4
|
"description": "marshall your npm/npm package installs with high quality and class 🎖",
|
|
5
5
|
"bin": {
|
|
6
6
|
"npq": "./bin/npq.js",
|
|
@@ -27,6 +27,7 @@
|
|
|
27
27
|
"bin/",
|
|
28
28
|
"data/",
|
|
29
29
|
"lib/",
|
|
30
|
+
"schema/",
|
|
30
31
|
"scripts/"
|
|
31
32
|
],
|
|
32
33
|
"author": {
|
|
@@ -52,6 +53,7 @@
|
|
|
52
53
|
},
|
|
53
54
|
"devDependencies": {
|
|
54
55
|
"@eslint/js": "^9.32.0",
|
|
56
|
+
"ajv": "^8.20.0",
|
|
55
57
|
"eslint": "^9.32.0",
|
|
56
58
|
"eslint-plugin-n": "^17.21.3",
|
|
57
59
|
"eslint-plugin-security": "^3.0.1",
|
|
@@ -0,0 +1,86 @@
|
|
|
1
|
+
{
|
|
2
|
+
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
3
|
+
"$id": "https://raw.githubusercontent.com/lirantal/npq/main/schema/npq-output-v1.schema.json",
|
|
4
|
+
"title": "npq JSON audit output v1",
|
|
5
|
+
"type": "object",
|
|
6
|
+
"additionalProperties": false,
|
|
7
|
+
"required": ["schemaVersion", "tool", "status", "summary", "packages", "failures"],
|
|
8
|
+
"properties": {
|
|
9
|
+
"schemaVersion": { "const": 1 },
|
|
10
|
+
"tool": { "$ref": "#/$defs/tool" },
|
|
11
|
+
"status": { "enum": ["clean", "findings", "failed"] },
|
|
12
|
+
"summary": { "$ref": "#/$defs/summary" },
|
|
13
|
+
"packages": { "type": "array", "items": { "$ref": "#/$defs/package" } },
|
|
14
|
+
"failures": { "type": "array", "items": { "$ref": "#/$defs/failure" } }
|
|
15
|
+
},
|
|
16
|
+
"$defs": {
|
|
17
|
+
"tool": {
|
|
18
|
+
"type": "object",
|
|
19
|
+
"additionalProperties": false,
|
|
20
|
+
"required": ["name", "version"],
|
|
21
|
+
"properties": {
|
|
22
|
+
"name": { "const": "npq" },
|
|
23
|
+
"version": { "type": "string", "minLength": 1 }
|
|
24
|
+
}
|
|
25
|
+
},
|
|
26
|
+
"summary": {
|
|
27
|
+
"type": "object",
|
|
28
|
+
"additionalProperties": false,
|
|
29
|
+
"required": ["packagesAudited", "errors", "warnings"],
|
|
30
|
+
"properties": {
|
|
31
|
+
"packagesAudited": { "type": "integer", "minimum": 0 },
|
|
32
|
+
"errors": { "type": "integer", "minimum": 0 },
|
|
33
|
+
"warnings": { "type": "integer", "minimum": 0 }
|
|
34
|
+
}
|
|
35
|
+
},
|
|
36
|
+
"package": {
|
|
37
|
+
"type": "object",
|
|
38
|
+
"additionalProperties": false,
|
|
39
|
+
"required": ["requested", "findings"],
|
|
40
|
+
"properties": {
|
|
41
|
+
"requested": { "type": "string", "minLength": 1 },
|
|
42
|
+
"findings": { "type": "array", "items": { "$ref": "#/$defs/finding" } }
|
|
43
|
+
}
|
|
44
|
+
},
|
|
45
|
+
"finding": {
|
|
46
|
+
"type": "object",
|
|
47
|
+
"additionalProperties": false,
|
|
48
|
+
"required": ["severity", "marshall", "category", "message"],
|
|
49
|
+
"properties": {
|
|
50
|
+
"severity": { "enum": ["warning", "error"] },
|
|
51
|
+
"marshall": { "type": "string", "minLength": 1 },
|
|
52
|
+
"category": { "$ref": "#/$defs/category" },
|
|
53
|
+
"message": { "type": "string" }
|
|
54
|
+
}
|
|
55
|
+
},
|
|
56
|
+
"category": {
|
|
57
|
+
"type": "object",
|
|
58
|
+
"additionalProperties": false,
|
|
59
|
+
"required": ["id", "title"],
|
|
60
|
+
"properties": {
|
|
61
|
+
"id": { "type": "string", "minLength": 1 },
|
|
62
|
+
"title": { "type": "string", "minLength": 1 }
|
|
63
|
+
}
|
|
64
|
+
},
|
|
65
|
+
"failure": {
|
|
66
|
+
"type": "object",
|
|
67
|
+
"additionalProperties": false,
|
|
68
|
+
"required": ["code", "message"],
|
|
69
|
+
"properties": {
|
|
70
|
+
"code": {
|
|
71
|
+
"enum": [
|
|
72
|
+
"INVALID_INPUT",
|
|
73
|
+
"PROJECT_MANIFEST_ERROR",
|
|
74
|
+
"PACKAGE_LOOKUP_FAILED",
|
|
75
|
+
"AUDIT_CHECK_FAILED",
|
|
76
|
+
"INTERRUPTED",
|
|
77
|
+
"INTERNAL_ERROR"
|
|
78
|
+
]
|
|
79
|
+
},
|
|
80
|
+
"message": { "type": "string", "minLength": 1 },
|
|
81
|
+
"package": { "type": "string", "minLength": 1 },
|
|
82
|
+
"marshall": { "type": "string", "minLength": 1 }
|
|
83
|
+
}
|
|
84
|
+
}
|
|
85
|
+
}
|
|
86
|
+
}
|