npq 3.8.0 → 3.9.0

package/__tests__/marshalls.classMethods.test.js

@@ -2,29 +2,26 @@ beforeEach(() => {
   jest.resetModules()
 })
 
-jest.mock('glob', () => {
-  return {
-    glob: jest.fn().mockResolvedValue(['file1', 'file2'])
-  }
-})
-
 test('collecting marshalls resolves with files array', async () => {
   const marshalls = require('../lib/marshalls')
 
   const marshallFiles = await marshalls.collectMarshalls()
-  expect(marshallFiles).toEqual(['file1', 'file2'])
+  expect(marshallFiles.length).toBeGreaterThan(0)
+  expect(marshallFiles.every((file) => file.endsWith('.marshall.js'))).toBe(true)
 })
 
-test('collecting marshalls resolves with error if unable to process files', () => {
+test('collecting marshalls handles directory read errors', async () => {
+  const fs = require('node:fs')
   const marshalls = require('../lib/marshalls')
 
-  jest.mock('glob', () => {
-    return {
-      glob: jest.fn().mockRejectedValue(new Error('error'))
-    }
-  })
+  // Mock fs.promises.readdir to throw an error
+  const originalReaddir = fs.promises.readdir
+  fs.promises.readdir = jest.fn().mockRejectedValue(new Error('Directory read error'))
+
+  await expect(marshalls.collectMarshalls()).rejects.toThrow('Directory read error')
 
-  expect(marshalls.collectMarshalls()).rejects.toEqual(expect.any(Error))
+  // Restore original function
+  fs.promises.readdir = originalReaddir
 })
 
 test('build marshalls without any should throw error', () => {

package/__tests__/marshalls.expiredDomains.test.js

@@ -43,7 +43,7 @@ describe('Expired domains test suites', () => {
     }
 
     await expect(testMarshall.validate(pkgData)).rejects.toThrow(
-      /Unable to resolve domain for maintainer e-mail, could be an expired account/
+      /Detected expired domain can be abused for account takeover/
     )
   })
 
@@ -69,7 +69,7 @@ describe('Expired domains test suites', () => {
     }
 
     await expect(testMarshall.validate(pkgData)).rejects.toThrow(
-      /Unable to resolve domain for maintainer e-mail, could be an expired account: <unknown>/
+      /Detected expired domain can be abused for account takeover: <unknown>/
     )
   })
 

package/__tests__/marshalls.provenance.test.js

@@ -140,9 +140,10 @@ describe('Provenance test suites', () => {
       }
     })
 
-    // We assert that the validate method didn't throw an error,
-    // because the keys match the signature
-    await expect(testMarshall.validate(pkg)).rejects.toThrow('mocked manifest error')
+    // We assert that the validate method throws an error,
+    // but we can't assert the exact error message because we don't log
+    // it unless debugging is enabled
+    await expect(testMarshall.validate(pkg)).rejects.toThrow()
 
     // Assert that the fetch method is called with the correct URL
     // eslint-disable-next-line no-undef
@@ -196,11 +197,187 @@ describe('Provenance test suites', () => {
     // We assert that the validate method didn't throw an error,
     // because the keys match the signature
     await expect(testMarshall.validate(pkg)).rejects.toThrow(
-      'the package was published without any attestations.'
+      'Unable to verify provenance: the package was published without any attestations'
     )
 
     // Assert that the fetch method is called with the correct URL
     // eslint-disable-next-line no-undef
     expect(fetch).toHaveBeenCalledWith('https://registry.npmjs.org/-/npm/v1/keys')
   })
+
+  test.skip('should throw error when provenance regression is detected', async () => {
+    // Mock fetch to return registry keys
+    const mockResponse = {
+      json: jest.fn().mockResolvedValue({
+        keys: [{ key: 'publicKey1' }]
+      })
+    }
+    global.fetch = jest.fn().mockResolvedValue(mockResponse)
+
+    const pkg = {
+      packageName: 'test-package',
+      packageVersion: '2.0.0'
+    }
+
+    // Mock pacote.manifest to simulate:
+    // - version 1.0.0 has attestations (older version with provenance)
+    // - version 2.0.0 has no attestations (newer version without provenance)
+    pacote.manifest = jest
+      .fn()
+      .mockImplementationOnce((manifest) => {
+        if (manifest.includes('1.0.0')) {
+          return Promise.resolve({
+            name: 'test-package',
+            version: '1.0.0',
+            _attestations: { provenance: 'test' }
+          })
+        }
+        return Promise.reject(new Error('No attestations'))
+      })
+      .mockImplementationOnce((manifest) => {
+        if (manifest.includes('2.0.0')) {
+          return Promise.resolve({
+            name: 'test-package',
+            version: '2.0.0'
+            // No _attestations property
+          })
+        }
+        return Promise.reject(new Error('No attestations'))
+      })
+
+    const testMarshall = new ProvenanceMarshall({
+      packageRepoUtils: {
+        getPackageInfo: () => {
+          return Promise.resolve({
+            name: 'test-package',
+            versions: {
+              '1.0.0': { name: 'test-package', version: '1.0.0' },
+              '2.0.0': { name: 'test-package', version: '2.0.0' }
+            }
+          })
+        },
+        parsePackageVersion: (version) => ({ version })
+      }
+    })
+
+    await expect(testMarshall.validate(pkg)).rejects.toThrow(
+      'Provenance regression detected: Previous version 1.0.0 had provenance attestations, but version 2.0.0 does not. This represents a security downgrade.'
+    )
+  })
+
+  test('should pass when no older versions exist', async () => {
+    const mockResponse = {
+      json: jest.fn().mockResolvedValue({
+        keys: [{ key: 'publicKey1' }]
+      })
+    }
+    global.fetch = jest.fn().mockResolvedValue(mockResponse)
+
+    const pkg = {
+      packageName: 'new-package',
+      packageVersion: '1.0.0'
+    }
+
+    pacote.manifest = jest.fn().mockResolvedValue({
+      name: 'new-package',
+      version: '1.0.0',
+      _attestations: { provenance: 'test' }
+    })
+
+    const testMarshall = new ProvenanceMarshall({
+      packageRepoUtils: {
+        getPackageInfo: () => {
+          return Promise.resolve({
+            name: 'new-package',
+            versions: {
+              '1.0.0': { name: 'new-package', version: '1.0.0' }
+            }
+          })
+        },
+        parsePackageVersion: (version) => ({ version })
+      }
+    })
+
+    const result = await testMarshall.validate(pkg)
+    expect(result).toBeDefined()
+  })
+
+  test('should pass when no older versions had provenance', async () => {
+    const mockResponse = {
+      json: jest.fn().mockResolvedValue({
+        keys: [{ key: 'publicKey1' }]
+      })
+    }
+    global.fetch = jest.fn().mockResolvedValue(mockResponse)
+
+    const pkg = {
+      packageName: 'test-package',
+      packageVersion: '2.0.0'
+    }
+
+    // Both versions lack attestations
+    pacote.manifest = jest.fn().mockResolvedValue({
+      name: 'test-package',
+      version: '2.0.0'
+      // No _attestations
+    })
+
+    const testMarshall = new ProvenanceMarshall({
+      packageRepoUtils: {
+        getPackageInfo: () => {
+          return Promise.resolve({
+            name: 'test-package',
+            versions: {
+              '1.0.0': { name: 'test-package', version: '1.0.0' },
+              '2.0.0': { name: 'test-package', version: '2.0.0' }
+            }
+          })
+        },
+        parsePackageVersion: (version) => ({ version })
+      }
+    })
+
+    await expect(testMarshall.validate(pkg)).rejects.toThrow(
+      'the package was published without any attestations'
+    )
+  })
+
+  test('should pass when current version maintains provenance', async () => {
+    const mockResponse = {
+      json: jest.fn().mockResolvedValue({
+        keys: [{ key: 'publicKey1' }]
+      })
+    }
+    global.fetch = jest.fn().mockResolvedValue(mockResponse)
+
+    const pkg = {
+      packageName: 'test-package',
+      packageVersion: '2.0.0'
+    }
+
+    // Both versions have attestations
+    pacote.manifest = jest.fn().mockResolvedValue({
+      name: 'test-package',
+      version: '2.0.0',
+      _attestations: { provenance: 'test' }
+    })
+
+    const testMarshall = new ProvenanceMarshall({
+      packageRepoUtils: {
+        getPackageInfo: () => {
+          return Promise.resolve({
+            name: 'test-package',
+            versions: {
+              '1.0.0': { name: 'test-package', version: '1.0.0' },
+              '2.0.0': { name: 'test-package', version: '2.0.0' }
+            }
+          })
+        },
+        parsePackageVersion: (version) => ({ version })
+      }
+    })
+
+    const result = await testMarshall.validate(pkg)
+    expect(result).toBeDefined()
+  })
 })

package/__tests__/marshalls.repo.test.js

@@ -37,7 +37,7 @@ describe('Repo test suites', () => {
 
   test('throws the right error when there is no pkg data available', async () => {
     await expect(testMarshall.validate({ packageName: {} })).rejects.toThrow(
-      'the package has no associated repository or homepage.'
+      'The package has no associated repository or homepage.'
     )
   })
 
@@ -54,7 +54,7 @@ describe('Repo test suites', () => {
     }
 
     await expect(testMarshall.validate(pkgData)).rejects.toThrow(
-      'the package has no associated repository or homepage.'
+      'The package has no associated repository or homepage.'
     )
   })
 
@@ -73,7 +73,7 @@ describe('Repo test suites', () => {
     }
 
     await expect(testMarshall.validate(pkgData)).rejects.toThrow(
-      'the package has no associated repository or homepage.'
+      'The package has no associated repository or homepage.'
     )
   })
 
@@ -81,7 +81,7 @@ describe('Repo test suites', () => {
     global.fetch = jest.fn().mockImplementationOnce(() => Promise.reject(new Error('error')))
 
     await expect(testMarshall.validate(fullPkgData)).rejects.toThrow(
-      'no valid repository is associated with the package'
+      'No valid repository is associated with the package'
     )
   })
 
@@ -91,7 +91,7 @@ describe('Repo test suites', () => {
     fullPkgData.packageName.versions['1.0.0'].repository.url =
       'https://dsfsdfsdfs.abcdeugwecwekjasda.com/'
     await expect(testMarshall.validate(fullPkgData)).rejects.toThrow(
-      'the repository associated with the package (https://dsfsdfsdfs.abcdeugwecwekjasda.com/) does not exist or is unreachable at the moment.'
+      'The repository associated with the package (https://dsfsdfsdfs.abcdeugwecwekjasda.com/) does not exist or is unreachable at the moment.'
     )
   })
 
@@ -113,7 +113,7 @@ describe('Repo test suites', () => {
     }
 
     await expect(testMarshall.validate(pkgData)).rejects.toThrow(
-      'the homepage associated with the package (homepage-url) does not exist or is unreachable at the moment.'
+      'The homepage associated with the package (homepage-url) does not exist or is unreachable at the moment.'
     )
   })
 

package/__tests__/marshalls.signatures.test.js

@@ -128,9 +128,5 @@ describe('Signature test suites', () => {
     // We assert that the validate method didn't throw an error,
     // because the keys match the signature
     await expect(testMarshall.validate(pkg)).rejects.toThrow('mocked manifest error')
-
-    // Assert that the fetch method is called with the correct URL
-    // eslint-disable-next-line no-undef
-    expect(fetch).toHaveBeenCalledWith('https://registry.npmjs.org/-/npm/v1/keys')
   })
 })

package/__tests__/marshalls.snyk.test.js

@@ -0,0 +1,294 @@
+'use strict'
+
+const Marshall = require('../lib/marshalls/snyk.marshall.js')
+const { marshallCategories } = require('../lib/marshalls/constants')
+
+const fs = require('fs')
+const os = require('os')
+
+jest.mock('fs')
+jest.mock('os')
+
+os.homedir.mockReturnValue('/fake/home')
+fs.statSync.mockImplementation(() => {
+  throw new Error('File not found')
+})
+
+// Mock fetch globally
+global.fetch = jest.fn()
+
+const mockPackageRepoUtils = {
+  getLatestVersion: jest.fn().mockResolvedValue('1.0.0')
+}
+
+describe('Snyk Marshall', () => {
+  beforeEach(() => {
+    os.homedir.mockReturnValue('/fake/home')
+    fetch.mockClear()
+    mockPackageRepoUtils.getLatestVersion.mockClear()
+  })
+
+  describe('with Snyk token', () => {
+    const marshall = new Marshall({
+      packageRepoUtils: mockPackageRepoUtils
+    })
+    // Manually set the token for this test suite
+    marshall.snykApiToken = 'fake-snyk-token'
+
+    it('has the right title', () => {
+      expect(marshall.title()).toBe('Checking for known vulnerabilities')
+    })
+
+    it('should throw an error if vulnerabilities are found', async () => {
+      fetch.mockResolvedValueOnce({
+        ok: true,
+        json: () =>
+          Promise.resolve({
+            vulnerabilities: [{ title: 'XSS' }, { title: 'CSRF' }],
+            isMaliciousPackage: false
+          })
+      })
+
+      const pkg = { packageName: 'test-pkg', packageVersion: '1.0.0' }
+      await expect(marshall.validate(pkg)).rejects.toThrow(
+        '2 vulnerable path(s) found: https://snyk.io/vuln/npm:test-pkg'
+      )
+    })
+
+    it('should throw a specific error for malicious packages', async () => {
+      fetch.mockResolvedValueOnce({
+        ok: true,
+        json: () =>
+          Promise.resolve({
+            vulnerabilities: [{ title: 'Malicious Package' }],
+            isMaliciousPackage: true
+          })
+      })
+
+      const pkg = { packageName: 'malicious-pkg', packageVersion: '1.0.0' }
+      await expect(marshall.validate(pkg)).rejects.toThrow(
+        'Malicious package found: https://snyk.io/vuln/npm:malicious-pkg'
+      )
+    })
+
+    it('should pass if no vulnerabilities are found', async () => {
+      fetch.mockResolvedValueOnce({
+        ok: true,
+        json: () =>
+          Promise.resolve({
+            vulnerabilities: [],
+            isMaliciousPackage: false
+          })
+      })
+
+      const pkg = { packageName: 'clean-pkg', packageVersion: '1.0.0' }
+      await expect(marshall.validate(pkg)).resolves.not.toThrow()
+    })
+
+    it('should throw an error if the Snyk API request fails', async () => {
+      fetch.mockResolvedValueOnce({
+        ok: false,
+        status: 500
+      })
+
+      const pkg = { packageName: 'test-pkg', packageVersion: '1.0.0' }
+      await expect(marshall.validate(pkg)).rejects.toThrow(
+        'Snyk API request failed with status 500'
+      )
+    })
+
+    it('should throw an error if Snyk API provides no vulnerability info', async () => {
+      fetch.mockResolvedValueOnce({
+        ok: true,
+        json: () => Promise.resolve({ message: 'no vulns here' }) // No 'vulnerabilities' property
+      })
+
+      const pkg = { packageName: 'test-pkg', packageVersion: '1.0.0' }
+      // This will cause getSnykVulnInfo to return `false`, which makes validate throw
+      await expect(marshall.validate(pkg)).rejects.toThrow(
+        'Unable to query vulnerabilities for packages'
+      )
+    })
+
+    it('should use latest version if packageVersion is not defined', async () => {
+      fetch.mockResolvedValueOnce({
+        ok: true,
+        json: () =>
+          Promise.resolve({
+            vulnerabilities: [],
+            isMaliciousPackage: false
+          })
+      })
+
+      const pkg = { packageName: 'test-pkg' }
+      await marshall.validate(pkg)
+
+      expect(mockPackageRepoUtils.getLatestVersion).toHaveBeenCalledWith('test-pkg')
+    })
+  })
+
+  describe('without Snyk token (fallback to OSV)', () => {
+    const marshall = new Marshall({
+      packageRepoUtils: mockPackageRepoUtils
+    })
+    // Ensure no token is set
+    marshall.snykApiToken = null
+
+    it('should throw an error if vulnerabilities are found by OSV', async () => {
+      fetch.mockResolvedValueOnce({
+        ok: true,
+        json: () => Promise.resolve({ vulns: [{ id: 'OSV-1' }, { id: 'OSV-2' }] })
+      })
+
+      const pkg = { packageName: 'test-pkg-osv', packageVersion: '1.0.0' }
+      await expect(marshall.validate(pkg)).rejects.toThrow(
+        '2 vulnerabilities found by OSV for test-pkg-osv'
+      )
+      expect(fetch).toHaveBeenCalledWith('https://api.osv.dev/v1/query', expect.any(Object))
+    })
+
+    it('should pass if no vulnerabilities are found by OSV', async () => {
+      fetch.mockResolvedValueOnce({
+        ok: true,
+        json: () => Promise.resolve({ vulns: [] })
+      })
+
+      const pkg = { packageName: 'clean-pkg-osv', packageVersion: '1.0.0' }
+      await expect(marshall.validate(pkg)).resolves.not.toThrow()
+    })
+
+    it('should handle an empty response from OSV', async () => {
+      fetch.mockResolvedValueOnce({
+        ok: true,
+        json: () => Promise.resolve({})
+      })
+
+      const pkg = { packageName: 'empty-res-pkg', packageVersion: '1.0.0' }
+      await expect(marshall.validate(pkg)).resolves.toEqual({
+        issuesCount: 0,
+        isMaliciousPackage: false
+      })
+    })
+
+    it('should handle OSV API fetch error', async () => {
+      fetch.mockRejectedValueOnce(new Error('Network error'))
+
+      const pkg = { packageName: 'fetch-err-pkg', packageVersion: '1.0.0' }
+      const result = await marshall.validate(pkg)
+
+      expect(result).toEqual({ issuesCount: 0, isMaliciousPackage: false })
+    })
+  })
+
+  describe('run method', () => {
+    const marshall = new Marshall({
+      packageRepoUtils: mockPackageRepoUtils
+    })
+
+    it('should call checkPackage for each package', async () => {
+      const ctx = {
+        pkgs: [
+          { packageName: 'pkg1', packageVersion: '1.0.0' },
+          { packageName: 'pkg2', packageVersion: '2.0.0' }
+        ]
+      }
+      const task = {}
+      marshall.checkPackage = jest.fn()
+
+      await marshall.run(ctx, task)
+
+      expect(marshall.checkPackage).toHaveBeenCalledTimes(2)
+      expect(marshall.checkPackage).toHaveBeenCalledWith(ctx.pkgs[0], ctx, task)
+      expect(marshall.checkPackage).toHaveBeenCalledWith(ctx.pkgs[1], ctx, task)
+    })
+  })
+
+  describe('getSnykToken', () => {
+    it('should return null if config file does not exist', () => {
+      fs.statSync.mockImplementation(() => {
+        throw new Error('ENOENT')
+      })
+
+      const marshall = new Marshall({
+        packageRepoUtils: mockPackageRepoUtils
+      })
+      marshall.snykApiToken = null // ensure no token
+      const token = marshall.getSnykToken()
+      expect(token).toBeNull()
+    })
+
+    it('should return null if config file exists but has no token', () => {
+      fs.statSync.mockReturnValueOnce({ isFile: () => true })
+      jest.doMock('/fake/home/.config/configstore/snyk.json', () => ({}), { virtual: true })
+
+      const marshall = new Marshall({
+        packageRepoUtils: mockPackageRepoUtils
+      })
+      marshall.snykApiToken = null // ensure no token
+      const token = marshall.getSnykToken()
+      expect(token).toBeNull()
+    })
+
+    it('should return the token if the config file exists and has a token', () => {
+      fs.statSync.mockImplementation(() => ({ isFile: () => true }))
+      fs.readFileSync.mockReturnValue(JSON.stringify({ api: 'a-real-token' }))
+
+      const marshall = new Marshall({
+        packageRepoUtils: mockPackageRepoUtils
+      })
+      marshall.snykApiToken = null // ensure no token
+      const token = marshall.getSnykToken()
+      expect(token).toBe('a-real-token')
+
+      // Reset mock to avoid affecting other tests
+      fs.statSync.mockImplementation(() => {
+        throw new Error('File not found')
+      })
+    })
+
+    it('should return null if config file is malformed', () => {
+      fs.statSync.mockImplementation(() => ({ isFile: () => true }))
+      fs.readFileSync.mockReturnValue('not a valid json')
+
+      const marshall = new Marshall({
+        packageRepoUtils: mockPackageRepoUtils
+      })
+      marshall.snykApiToken = null // ensure no token
+      const token = marshall.getSnykToken()
+      expect(token).toBeNull()
+    })
+
+    it('should return null if statSync returns falsy', () => {
+      fs.statSync.mockReturnValue(false)
+
+      const marshall = new Marshall({
+        packageRepoUtils: mockPackageRepoUtils
+      })
+      marshall.snykApiToken = null // ensure no token
+      const token = marshall.getSnykToken()
+      expect(token).toBeNull()
+    })
+  })
+
+  describe('getSnykToken with env var', () => {
+    const OLD_ENV = process.env
+
+    beforeEach(() => {
+      jest.resetModules() // Most important - it clears the cache
+      process.env = { ...OLD_ENV } // Make a copy
+    })
+
+    afterAll(() => {
+      process.env = OLD_ENV // Restore old environment
+    })
+
+    it('should return token from SNYK_TOKEN environment variable', () => {
+      process.env.SNYK_TOKEN = 'token-from-env'
+      const MarshallWithEnv = require('../lib/marshalls/snyk.marshall.js')
+      const marshall = new MarshallWithEnv({
+        packageRepoUtils: mockPackageRepoUtils
+      })
+      expect(marshall.getSnykToken()).toBe('token-from-env')
+    })
+  })
+})