npq 3.27.0 → 3.27.2

package/README.md

@@ -140,7 +140,7 @@ Note: `npq` by default will offload all commands and their arguments to the `npm
 | Marshall Name    | Description                                                                                                                                                                                                                                                                                               | Notes                                                                                                                                                                                       |
 | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | age              | Will show a warning for a package if its age on npm is less than 22 days                                                                                                                                                                                                                                  | Checks a package creation date, not a specific version                                                                                                                                      |
-| author           | Validates the resolved version’s publisher (`_npmUser`), flags a **new** maintainer on the package (first publish by that email within 21 days), **dormant maintainer** gaps (warning if over ~6 months since their last publish on that package, error if over ~9 months), and very **recent** publishes | See [docs/feature/author-marshall.md](docs/feature/author-marshall.md)                                                                                                                      |
+| author           | Validates the resolved version’s publisher (`_npmUser`), flags a **new** maintainer on the package (first publish by that email or trusted publisher configuration within 21 days), **dormant maintainer** gaps on versions published within 30 days (warning if over ~6 months since their last publish on that package, error if over ~9 months), and very **recent** publishes | See [docs/feature/author-marshall.md](docs/feature/author-marshall.md)                                                                                                                      |
 | downloads        | Will show a warning for a package if its download count in the last month is less than 20                                                                                                                                                                                                                 | Reports `not evaluated` for custom-registry packages instead of querying the public npm downloads service                                                                                   |
 | readme           | Will show a warning if a package has no README or it has been detected as a security placeholder package by npm staff                                                                                                                                                                                     |
 | repo             | Will show a warning if a package has been found without a valid and working repository URL                                                                                                                                                                                                                | Checks the latest version for a repository URL                                                                                                                                              |

package/lib/marshalls/author.marshall.js

@@ -5,6 +5,9 @@
  *
  * This marshall performs three security checks related to package publishing:
  *
+ * Publishers are identified by `_npmUser.email`. Trusted publishing (OIDC) releases share one
+ * npm-wide email, so they are identified by `_npmUser.trustedPublisher.oidcConfigId` instead.
+ *
  * 1. NEW AUTHOR CHECK
  *    Detects if this is the first version ever published by this user for this package.
  *    - Condition: No prior versions exist from this user, OR the current version is their first.
@@ -14,47 +17,67 @@
  *      it's not a current risk.
  *
  * 2. DORMANT MAINTAINER CHECK
- *    Detects if the same maintainer (_npmUser email) had a prior publish on this package,
+ *    Detects if the same publisher had a prior publish on this package,
  *    then a long gap before the current version.
+ *    - Only flags if the version was published recently (≤30 days ago).
  *    - Gap > ~9 months: Error
  *    - Gap > ~6 months (and ≤9 months): Warning
  *    - Strict boundaries: exactly 183 or 274 days does not cross the next tier.
  *    - Rationale: Long-inactive accounts publishing again can indicate compromise or neglected keys.
+ *      A version that has been public for longer has had time to be noticed and unpublished.
  *
  * 3. VERSION RECENCY CHECK
  *    Detects if the current version being installed was published very recently.
  *    - ≤7 days: Throws an Error (high risk)
  *    - ≤30 days: Throws a Warning (moderate risk)
- *    - Only applies if version is ≤45 days old.
  *    - Rationale: Very recently published versions haven't had time for community review
  *      and could contain undiscovered malicious code. This is independent of author history.
  *
- * Checks run in order (1 → 2 → 3); the first thrown Error or Warning ends validation.
+ * Checks run in order (1 → 2 → 3); the first thrown Error or Warning ends validation, except that
+ * a dormant maintainer Warning is reported only if the version recency check finds no Error.
  */
 
 const BaseMarshall = require('./baseMarshall')
 const Warning = require('../helpers/warning')
-const { MAX_VERSION_RECENCY_DAYS } = require('../helpers/versionAge')
+const { MAX_VERSION_RECENCY_DAYS, getRoundedVersionAgeDays } = require('../helpers/versionAge')
 const { marshallCategories } = require('./constants')
 
 const MARSHALL_NAME = 'author'
 const DORMANT_MAINTAINER_WARNING_DAYS = Math.round(365.25 / 2) // ~6 months (183)
 const DORMANT_MAINTAINER_ERROR_DAYS = Math.round(365.25 * 0.75) // ~9 months (274)
 
-/**
- * Latest publish time (ms) for `email` on this package strictly before `packageVersion`'s time.
- * @returns {number|null}
- */
-function findLastPriorPublishTimeMsForEmail(pakument, packageVersion, email) {
-  const currentTimeStr = pakument.time && pakument.time[packageVersion]
-  if (!currentTimeStr || typeof currentTimeStr !== 'string') {
+function getTrustedPublisherConfigId(npmUser) {
+  const oidcConfigId = npmUser && npmUser.trustedPublisher && npmUser.trustedPublisher.oidcConfigId
+  if (typeof oidcConfigId !== 'string' || oidcConfigId === '') {
     return null
   }
-  const currentMs = Date.parse(currentTimeStr)
-  if (Number.isNaN(currentMs)) {
+  // The registry records the same configuration both with and without this prefix
+  return `oidc:${oidcConfigId.replace(/^oidc:/, '')}`
+}
+
+/**
+ * Identity used to compare publishers of this package's versions.
+ * @returns {string|null}
+ */
+function getPublisherIdentity(npmUser) {
+  if (!npmUser) {
     return null
   }
+  const oidcConfigId = getTrustedPublisherConfigId(npmUser)
+  return oidcConfigId ? `trusted-publisher:${oidcConfigId}` : npmUser.email || null
+}
 
+function describePublisher(npmUser) {
+  const oidcConfigId = getTrustedPublisherConfigId(npmUser)
+  const trustedPublisher = oidcConfigId ? ` (trusted publisher ${oidcConfigId})` : ''
+  return `${npmUser.name} <${npmUser.email}>${trustedPublisher}`
+}
+
+/**
+ * Latest publish time (ms) for `publisherIdentity` on this package strictly before `currentMs`.
+ * @returns {number|null}
+ */
+function findLastPriorPublishTimeMsForPublisher(pakument, currentMs, publisherIdentity) {
   let bestMs = null
   for (const v of Object.keys(pakument.versions || {})) {
     const t = pakument.time && pakument.time[v]
@@ -62,7 +85,7 @@ function findLastPriorPublishTimeMsForEmail(pakument, packageVersion, email) {
       continue
     }
     const ver = pakument.versions[v]
-    if (!ver || !ver._npmUser || ver._npmUser.email !== email) {
+    if (!ver || getPublisherIdentity(ver._npmUser) !== publisherIdentity) {
       continue
     }
     const priorMs = Date.parse(t)
@@ -94,7 +117,8 @@ class Marshall extends BaseMarshall {
    * Performs three checks:
    * 1. New Author Check: Flags if this is the user's first publish of this package
    *    AND the version was published within the last 21 days.
-   * 2. Dormant Maintainer Check: Prior publish by same email with a long gap before this release.
+   * 2. Dormant Maintainer Check: Prior publish by the same publisher with a long gap before this
+   *    release, only when this version was published within the last 30 days.
    * 3. Version Recency Check: Flags recently published versions regardless of author:
    *    - Error if ≤7 days old
    *    - Warning if ≤30 days old
@@ -128,10 +152,11 @@ class Marshall extends BaseMarshall {
       throw new Error('The publishing user has no valid email address')
     }
 
+    const publisherIdentity = getPublisherIdentity(npmUser)
     let firstVersionForUser = null
     const versionPublishedDateString = pakument.time[packageVersion]
     for (const versionMetadata of Object.values(pakument.versions)) {
-      if (versionMetadata._npmUser && versionMetadata._npmUser.email === npmUser.email) {
+      if (getPublisherIdentity(versionMetadata._npmUser) === publisherIdentity) {
         firstVersionForUser = versionMetadata
         break
       }
@@ -149,7 +174,7 @@ class Marshall extends BaseMarshall {
 
         if (dateDiffInDays <= 21) {
           throw new Error(
-            `The user ${npmUser.name} <${npmUser.email}> published this package for the first time only ${dateDiffInDays} days ago`
+            `The user ${describePublisher(npmUser)} published this package for the first time only ${dateDiffInDays} days ago`
           )
         }
       }
@@ -163,29 +188,32 @@ class Marshall extends BaseMarshall {
       // )
     }
 
-    const priorPublishMs = findLastPriorPublishTimeMsForEmail(
-      pakument,
-      packageVersion,
-      npmUser.email
-    )
-    if (priorPublishMs !== null && versionPublishedDateString) {
-      const currentMs = Date.parse(versionPublishedDateString)
-      if (!Number.isNaN(currentMs)) {
-        const gapMs = currentMs - priorPublishMs
-        let gapDays = 0
-        if (gapMs > 0) {
-          gapDays = Math.round(gapMs / (1000 * 60 * 60 * 24))
-        }
-        if (gapDays > DORMANT_MAINTAINER_ERROR_DAYS) {
-          throw new Error(
-            `The maintainer ${npmUser.name} <${npmUser.email}> had not published this package for ${gapDays} days before this release (more than 9 months dormant)`
-          )
-        }
-        if (gapDays > DORMANT_MAINTAINER_WARNING_DAYS) {
-          throw new Warning(
-            `The maintainer ${npmUser.name} <${npmUser.email}> had not published this package for ${gapDays} days before this release (more than 6 months dormant)`
-          )
-        }
+    // A long-public version has had time to be noticed and unpublished, so like the new-author
+    // check, the dormant check only applies to versions inside the version recency window
+    const versionAgeDays = getRoundedVersionAgeDays(versionPublishedDateString)
+    const currentMs = Date.parse(versionPublishedDateString)
+    const priorPublishMs =
+      versionAgeDays !== null && versionAgeDays <= MAX_VERSION_RECENCY_DAYS
+        ? findLastPriorPublishTimeMsForPublisher(pakument, currentMs, publisherIdentity)
+        : null
+    // A dormant Warning is held until the version recency Error check runs, so it never
+    // downgrades a more severe finding
+    let dormantWarning = null
+    if (priorPublishMs !== null) {
+      const gapMs = currentMs - priorPublishMs
+      let gapDays = 0
+      if (gapMs > 0) {
+        gapDays = Math.round(gapMs / (1000 * 60 * 60 * 24))
+      }
+      if (gapDays > DORMANT_MAINTAINER_ERROR_DAYS) {
+        throw new Error(
+          `The maintainer ${describePublisher(npmUser)} had not published this package for ${gapDays} days before this release (more than 9 months dormant)`
+        )
+      }
+      if (gapDays > DORMANT_MAINTAINER_WARNING_DAYS) {
+        dormantWarning = new Warning(
+          `The maintainer ${describePublisher(npmUser)} had not published this package for ${gapDays} days before this release (more than 6 months dormant)`
+        )
       }
     }
 
@@ -196,18 +224,20 @@ class Marshall extends BaseMarshall {
       dateDiffVersionPublished = Math.round(dateDiffInMsVersionPublished / (1000 * 60 * 60 * 24))
     }
 
-    if (dateDiffVersionPublished <= 45) {
-      if (dateDiffVersionPublished <= 7) {
-        throw new Error(
-          `This version was published only ${dateDiffVersionPublished} days ago by ${npmUser.name} <${npmUser.email}>`
-        )
-      }
+    if (dateDiffVersionPublished <= 7) {
+      throw new Error(
+        `This version was published only ${dateDiffVersionPublished} days ago by ${npmUser.name} <${npmUser.email}>`
+      )
+    }
 
-      if (dateDiffVersionPublished <= MAX_VERSION_RECENCY_DAYS) {
-        throw new Warning(
-          `This version was published only ${dateDiffVersionPublished} days ago by ${npmUser.name} <${npmUser.email}>`
-        )
-      }
+    if (dormantWarning) {
+      throw dormantWarning
+    }
+
+    if (dateDiffVersionPublished <= MAX_VERSION_RECENCY_DAYS) {
+      throw new Warning(
+        `This version was published only ${dateDiffVersionPublished} days ago by ${npmUser.name} <${npmUser.email}>`
+      )
     }
 
     return versionPublishedDateString

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "3.27.0",
+  "version": "3.27.2",
   "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",