npq 3.4.8 → 3.5.1

package/README.md

@@ -28,7 +28,6 @@ Media coverage about npq:
 - JavaScript January advent calendar's post on [Open Source From Heaven, Modules From Hell](https://www.lirantal.com/blog/2019-01-26)
 - Liran Tal's [Malicious Modules — what you need to know when installing npm packages](https://www.lirantal.com/blog/malicious-modules-what-you-need-to-know-when-installing-npm-packages-12b2f56d3685)
 
-
 ## About
 
 Once npq is installed, you can safely* install packages:
@@ -118,20 +117,6 @@ MARSHALL_DISABLE_SNYK=1 npq install express
 npq install express --dry-run
 ```
 
-### Using with TravisCI
-
-An example of using lockfile-lint with a `.travis.yml` configuration as part of your build:
-
-```
-language: node_js
-before_script:
-  - npx lockfile-lint --path package-lock.json --validate-https --allowed-hosts npm
-install:
-  - yarn install
-script:
-  - yarn run test
-```
-
 ## FAQ
 1. **Can I use NPQ without having npm or yarn?**
 * NPQ will audit a package for possible security issues, but it isn't a replacement for npm or yarn. When you choose to continue installing the package, it will offload the installation process to your choice of either npm or yarn.

package/lib/marshalls/age.marshall.js

@@ -5,6 +5,7 @@ const { marshallCategories } = require('./constants')
 
 const MARSHALL_NAME = 'age'
 const PACKAGE_AGE_THRESHOLD = 22 // specified in days
+const PACKAGE_AGE_UNMAINTAINED_RISK = 365 // specified in days
 
 class Marshall extends BaseMarshall {
   constructor(options) {
@@ -18,22 +19,49 @@ class Marshall extends BaseMarshall {
   }
 
   validate(pkg) {
-    return this.packageRepoUtils.getPackageInfo(pkg.packageName).then((data) => {
-      if (data && data.time && data.time.created) {
-        const pkgCreatedDate = data.time.created
-        const dateDiff = Date.now() - Date.parse(pkgCreatedDate)
-
-        if (dateDiff < PACKAGE_AGE_THRESHOLD) {
-          throw new Error(
-            `detected a newly published package (created < ${PACKAGE_AGE_THRESHOLD} days) act carefully`
-          )
+    let packageData = null
+    let ageDateDiff = null
+    return this.packageRepoUtils
+      .getPackageInfo(pkg.packageName)
+      .then((data) => {
+        if (data && data.time && data.time.created) {
+          packageData = data
+          const pkgCreatedDate = data.time.created
+          const dateDiff = Date.now() - Date.parse(pkgCreatedDate)
+
+          ageDateDiff = dateDiff
+          if (dateDiff < PACKAGE_AGE_THRESHOLD) {
+            throw new Error(
+              `detected a newly published package (created < ${PACKAGE_AGE_THRESHOLD} days) act carefully`
+            )
+          }
+
+          return pkg
+        } else {
+          throw new Error('could not determine package age')
         }
+      })
+      .then((pkg) => {
+        return this.packageRepoUtils.getSemVer(pkg.packageName, pkg.packageVersion)
+      })
+      .then((versionResolved) => {
+        const versionReleaseDate = packageData.time[versionResolved]
+        const versionDateDiff = new Date() - new Date(versionReleaseDate)
+
+        const versionDateDiffInDays = Math.round(versionDateDiff / (1000 * 60 * 60 * 24))
+
+        let timeAgoText = 'days'
+        let timeAgoNumber = versionDateDiffInDays
 
-        return dateDiff
-      } else {
-        throw new Error('could not determine package age')
-      }
-    })
+        if (versionDateDiffInDays >= 365) {
+          timeAgoText = 'years'
+          timeAgoNumber = Math.floor(versionDateDiffInDays / 365)
+        }
+
+        if (versionDateDiffInDays >= PACKAGE_AGE_UNMAINTAINED_RISK) {
+          throw new Error(`detected an old package (created ${timeAgoNumber} ${timeAgoText} ago)`)
+        }
+      })
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "3.4.8",
+  "version": "3.5.1",
   "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",