npq 3.27.1 → 3.27.2

package/lib/marshalls/author.marshall.js

@@ -30,11 +30,11 @@
  *    Detects if the current version being installed was published very recently.
  *    - ≤7 days: Throws an Error (high risk)
  *    - ≤30 days: Throws a Warning (moderate risk)
- *    - Only applies if version is ≤45 days old.
  *    - Rationale: Very recently published versions haven't had time for community review
  *      and could contain undiscovered malicious code. This is independent of author history.
  *
- * Checks run in order (1 → 2 → 3); the first thrown Error or Warning ends validation.
+ * Checks run in order (1 → 2 → 3); the first thrown Error or Warning ends validation, except that
+ * a dormant maintainer Warning is reported only if the version recency check finds no Error.
  */
 
 const BaseMarshall = require('./baseMarshall')
@@ -196,6 +196,9 @@ class Marshall extends BaseMarshall {
       versionAgeDays !== null && versionAgeDays <= MAX_VERSION_RECENCY_DAYS
         ? findLastPriorPublishTimeMsForPublisher(pakument, currentMs, publisherIdentity)
         : null
+    // A dormant Warning is held until the version recency Error check runs, so it never
+    // downgrades a more severe finding
+    let dormantWarning = null
     if (priorPublishMs !== null) {
       const gapMs = currentMs - priorPublishMs
       let gapDays = 0
@@ -208,7 +211,7 @@ class Marshall extends BaseMarshall {
         )
       }
       if (gapDays > DORMANT_MAINTAINER_WARNING_DAYS) {
-        throw new Warning(
+        dormantWarning = new Warning(
           `The maintainer ${describePublisher(npmUser)} had not published this package for ${gapDays} days before this release (more than 6 months dormant)`
         )
       }
@@ -221,18 +224,20 @@ class Marshall extends BaseMarshall {
       dateDiffVersionPublished = Math.round(dateDiffInMsVersionPublished / (1000 * 60 * 60 * 24))
     }
 
-    if (dateDiffVersionPublished <= 45) {
-      if (dateDiffVersionPublished <= 7) {
-        throw new Error(
-          `This version was published only ${dateDiffVersionPublished} days ago by ${npmUser.name} <${npmUser.email}>`
-        )
-      }
+    if (dateDiffVersionPublished <= 7) {
+      throw new Error(
+        `This version was published only ${dateDiffVersionPublished} days ago by ${npmUser.name} <${npmUser.email}>`
+      )
+    }
 
-      if (dateDiffVersionPublished <= MAX_VERSION_RECENCY_DAYS) {
-        throw new Warning(
-          `This version was published only ${dateDiffVersionPublished} days ago by ${npmUser.name} <${npmUser.email}>`
-        )
-      }
+    if (dormantWarning) {
+      throw dormantWarning
+    }
+
+    if (dateDiffVersionPublished <= MAX_VERSION_RECENCY_DAYS) {
+      throw new Warning(
+        `This version was published only ${dateDiffVersionPublished} days ago by ${npmUser.name} <${npmUser.email}>`
+      )
     }
 
     return versionPublishedDateString

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "3.27.1",
+  "version": "3.27.2",
   "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",