npq 3.8.0 → 3.9.0

package/lib/helpers/cliSupportHandler.js

@@ -1,6 +1,7 @@
 'use strict'
 
-const color = require('kleur')
+const { styleText } = require('node:util')
+
 // eslint-disable-next-line security/detect-child-process
 const childProcess = require('child_process')
 const semver = require('semver')
@@ -9,17 +10,22 @@ const DEFAULT_PKGMGR = process.env.NPQ_PKG_MGR || 'npm'
 
 const nodeVersion = process.versions.node
 
-module.exports.isEnvSupport = function () {
-  if (!semver.satisfies(nodeVersion, '>=7.6.0')) {
+function isEnvSupport() {
+  if (!semver.satisfies(nodeVersion, '>=20.13.0')) {
     return false
   }
 
   return true
 }
 
-module.exports.noSupportError = function (failFast) {
-  // eslint-disable-next-line no-console
-  console.error(color.red('error:'), 'npq suppressed due to old node version')
+function noSupportError(failFast) {
+  if (isInteractiveTerminal()) {
+    // eslint-disable-next-line no-console
+    console.error(styleText('red', 'error:'), 'npq suppressed due to old node version')
+  } else {
+    // eslint-disable-next-line no-console
+    console.error('error: npq suppressed due to old node version')
+  }
 
   if (failFast === true) {
     process.exit(-1)
@@ -28,7 +34,7 @@ module.exports.noSupportError = function (failFast) {
   return true
 }
 
-module.exports.packageManagerPassthrough = function () {
+function packageManagerPassthrough() {
   const result = childProcess.spawnSync(DEFAULT_PKGMGR, process.argv.slice(2), {
     stdio: 'inherit',
     shell: true
@@ -36,3 +42,40 @@ module.exports.packageManagerPassthrough = function () {
 
   process.exit(result.status)
 }
+
+/**
+ * Check if we're running in an interactive terminal environment
+ * @returns {boolean} True if interactive, false if in CI/build environment
+ */
+function isInteractiveTerminal() {
+  // Check common CI environment variables
+  const ciEnvVars = [
+    'CI',
+    'CONTINUOUS_INTEGRATION',
+    'BUILD_NUMBER',
+    'RUN_ID',
+    'GITHUB_ACTIONS',
+    'GITLAB_CI',
+    'TRAVIS',
+    'CIRCLECI',
+    'JENKINS_URL',
+    'TEAMCITY_VERSION',
+    'TF_BUILD'
+  ]
+
+  // If any CI environment variable is set, we're likely in a CI environment
+  const isCI = ciEnvVars.some((envVar) => process.env[envVar])
+
+  // Check if stdout is a TTY (terminal)
+  const isTTY = Boolean(process.stdout.isTTY)
+
+  // We're interactive if we're in a TTY and not in CI
+  return isTTY && !isCI
+}
+
+module.exports = {
+  isEnvSupport,
+  noSupportError,
+  packageManagerPassthrough,
+  isInteractiveTerminal
+}

package/lib/helpers/packageRepoUtils.js

@@ -52,6 +52,11 @@ class PackageRepoUtils {
     return semver.coerce(version)
   }
 
+  async isPackageInAllowList(packageName) {
+    const allowList = ['npq', 'ai', 'bun', 'deno']
+    return allowList.includes(packageName)
+  }
+
   async getSemVer(packageName, packageVersion) {
     if (semver.valid(packageVersion)) {
       return packageVersion
@@ -61,7 +66,7 @@ class PackageRepoUtils {
       const packageInfo = await this.getPackageInfo(packageName)
 
       if (packageInfo['dist-tags'] === undefined) {
-        throw new Error(`could not find dist-tags for package ${packageName}`)
+        throw new Error(`Could not find dist-tags for package ${packageName}`)
       }
 
       if (packageInfo['dist-tags'][packageVersion] !== undefined) {
@@ -85,7 +90,7 @@ class PackageRepoUtils {
         }
       }
 
-      throw new Error(`could not find dist-tag ${packageVersion} for package ${packageName}`)
+      throw new Error(`Could not find dist-tag ${packageVersion} for package ${packageName}`)
     }
   }
 }

package/lib/helpers/promiseThrottler.js

@@ -0,0 +1,96 @@
+// Example use-case
+//
+// Using the new throttling mechanism - each audit will be throttled globally
+// const throttledAudits = pkgs.map(pkg =>
+//     promiseThrottle(() => auditPackage(pkg), 1, 1000) // max 1 concurrent, 1 second delay
+//   )
+// const res = await Promise.all(throttledAudits)
+
+/**
+ * A function that throttles promises to avoid overwhelming remote APIs
+ * rate limits. Uses a global throttling mechanism that works across
+ * multiple concurrent calls.
+ *
+ * @param {Function} promiseFunction - Function that returns a promise
+ * @param {number} maxConcurrent - Maximum concurrent promises (global setting)
+ * @param {number} delay - Minimum delay between requests in milliseconds
+ */
+async function promiseThrottleHelper(promiseFunction, maxConcurrent = 5, delay = 0) {
+  const throttler = PromiseThrottler.getInstance()
+
+  // Configure global throttling settings
+  throttler.configure(maxConcurrent, delay)
+
+  // Use the global throttler
+  return throttler.throttle(promiseFunction)
+}
+
+/**
+ * A throttling class that limits concurrent promise execution across all instances
+ * to avoid overwhelming remote APIs with rate limits.
+ */
+class PromiseThrottler {
+  constructor() {
+    if (!PromiseThrottler.instance) {
+      this.runningCount = 0
+      this.queue = []
+      this.maxConcurrent = 5
+      this.minDelay = 0
+      PromiseThrottler.instance = this
+    }
+    return PromiseThrottler.instance
+  }
+
+  static getInstance() {
+    if (!PromiseThrottler.instance) {
+      new PromiseThrottler()
+    }
+    return PromiseThrottler.instance
+  }
+
+  configure(maxConcurrent = 5, minDelay = 0) {
+    this.maxConcurrent = maxConcurrent
+    this.minDelay = minDelay
+  }
+
+  async processQueue() {
+    while (this.queue.length > 0 && this.runningCount < this.maxConcurrent) {
+      const { promiseFunction, resolve, reject } = this.queue.shift()
+      this.runningCount++
+
+      try {
+        const startTime = Date.now()
+        const result = await promiseFunction()
+
+        // Ensure minimum delay between requests
+        if (this.minDelay > 0) {
+          const elapsed = Date.now() - startTime
+          const remainingDelay = this.minDelay - elapsed
+          if (remainingDelay > 0) {
+            await new Promise((r) => setTimeout(r, remainingDelay))
+          }
+        }
+
+        resolve(result)
+      } catch (error) {
+        reject(error)
+      } finally {
+        this.runningCount--
+        // Process next items in queue
+        setImmediate(() => this.processQueue())
+      }
+    }
+  }
+
+  async throttle(promiseFunction) {
+    return new Promise((resolve, reject) => {
+      this.queue.push({ promiseFunction, resolve, reject })
+      this.processQueue()
+    })
+  }
+}
+
+module.exports = {
+  promiseThrottleHelper,
+  PromiseThrottler
+}

package/lib/helpers/reportResults.js

@@ -0,0 +1,304 @@
+const { styleText } = require('node:util')
+const { marshallCategories } = require('../marshalls/constants')
+const { isInteractiveTerminal } = require('./cliSupportHandler')
+
+/**
+ * Get terminal width, with fallback to a reasonable default
+ * @returns {number} Terminal width in columns
+ */
+function getTerminalWidth() {
+  try {
+    if (process.stdout.isTTY && process.stdout.getWindowSize) {
+      const [columns] = process.stdout.getWindowSize()
+      return columns
+    }
+  } catch (error) {
+    // Fallback if terminal size detection fails
+  }
+  return 80 // Default fallback width
+}
+
+/**
+ * Strip ANSI escape codes from a string to get its actual display length
+ * @param {string} str - String that may contain ANSI codes
+ * @returns {number} Actual display length
+ */
+function getDisplayLength(str) {
+  // Remove ANSI escape sequences to get actual character count
+  return str.replace(/\u001b\[[0-9;]*m/g, '').length
+}
+
+/**
+ * Wrap text to fit within terminal width while maintaining indentation
+ * @param {string} text - Text to wrap
+ * @param {number} maxWidth - Maximum width for each line
+ * @param {string} indent - Indentation string for continuation lines
+ * @returns {string} Wrapped text with proper indentation
+ */
+function wrapTextWithIndent(text, maxWidth, indent) {
+  if (getDisplayLength(text) <= maxWidth) {
+    return text
+  }
+
+  const words = text.split(' ')
+  const lines = []
+  let currentLine = ''
+
+  for (const word of words) {
+    const testLine = currentLine ? `${currentLine} ${word}` : word
+
+    if (getDisplayLength(testLine) <= maxWidth) {
+      currentLine = testLine
+    } else {
+      if (currentLine) {
+        lines.push(currentLine)
+        currentLine = word
+      } else {
+        // Single word is longer than maxWidth, break it
+        lines.push(word)
+        currentLine = ''
+      }
+    }
+  }
+
+  if (currentLine) {
+    lines.push(currentLine)
+  }
+
+  // Join lines with proper indentation
+  return lines
+    .map((line, index) => {
+      return index === 0 ? line : `\n${indent}${line}`
+    })
+    .join('')
+}
+
+/**
+ * Report scan results to the console with colored formatting
+ * @param {Array} marshallResults - Array of package scan results
+ * @param {string} results[].pkg - Package name
+ * @param {Array<Array>} results[].errors - Array of error arrays, each containing error objects with pkg and message
+ * @param {Array<Array>} results[].warnings - Array of warning arrays, each containing warning objects with pkg and message
+ */
+function reportResults(marshallResults, { plain = false } = {}) {
+  // Convert results to issues per package
+  const results = marshallResultsToIssuesPerPackage(marshallResults)
+
+  let resultsForPrettyPrint = ''
+  let resultsForJSON = results
+  let resultsForPlainTextPrint = ''
+
+  let summaryForPrettyPrint = ''
+  let summaryForPlainTextPrint = ''
+  // @TODO: add support for JSON output
+  // let summaryForJSON =
+
+  if (!Array.isArray(results) || results.length === 0) {
+    return
+  }
+
+  // Check if we should use rich formatting
+  const useRichFormatting = isInteractiveTerminal() && !plain
+
+  // Get terminal width for text wrapping
+  const terminalWidth = getTerminalWidth()
+
+  let countErrors = 0
+  let countWarnings = 0
+  let countPackages = results.length
+
+  results.forEach((result, index) => {
+    // Add spacing between packages (except for the first one)
+    if (index > 0) {
+      resultsForPrettyPrint += ''
+      resultsForPlainTextPrint += '\n'
+    }
+
+    // Rich formatting version
+    const packageNameRich = styleText(['bold'], result.pkg)
+    const prefixRich = styleText(['gray'], `${'│'}`)
+    const promptRich = styleText(['gray', 'dim'], `${'>'} `)
+    const separatorRich = styleText(['dim'], `${'·'}`)
+
+    resultsForPrettyPrint += `\n ${styleText(['dim'], '┌─')}`
+    resultsForPrettyPrint += `\n ${prefixRich} ${promptRich} ${packageNameRich}`
+    resultsForPrettyPrint += `\n ${prefixRich}`
+
+    // Plain text version
+    resultsForPlainTextPrint += `\n--- Package: ${result.pkg} ---`
+
+    // TBD later change to actually calc'ing it instead of hardcoding
+    const maxTextLength = 'Supply Chain Security'.length
+
+    // Calculate the prefix length for indentation (without ANSI codes)
+    // Format: " │ ✖ Supply Chain Security · "
+    const basePrefix = ` │ ✖ `
+    const topicPadding = maxTextLength + 0 // +1 for space after topic
+    const separatorLength = 3 // ` · `
+    const prefixLength = basePrefix.length + topicPadding + separatorLength
+    const maxMessageWidth = terminalWidth - prefixLength - 2 // -2 for safety margin
+
+    // Create indentation string for wrapped lines - include the │ prefix and align with message start
+    const indentString = ` ${styleText(['gray'], '│')} ${' '.repeat(prefixLength - 3)}`
+
+    let isPackageMalicious = null
+
+    if (result.errors && result.errors.length > 0) {
+      for (const errorArray of result.errors) {
+        isPackageMalicious = errorArray.find((error) => {
+          return error.message.includes('Malicious package found')
+        })
+
+        if (isPackageMalicious) {
+          break
+        }
+      }
+
+      if (isPackageMalicious) {
+        countErrors = 1
+
+        // Rich formatting version
+        const topicRich = styleText(
+          ['red', 'bold'],
+          isPackageMalicious.categoryFriendlyName.padEnd(maxTextLength, ' ')
+        )
+        const iconRich = styleText(['red', 'bold'], `✖`)
+        const errorLineRich = ` ${prefixRich} ${iconRich} ${topicRich} ${separatorRich} ${isPackageMalicious.message} `
+        resultsForPrettyPrint += `\n${errorLineRich}`
+
+        // Plain text version
+        resultsForPlainTextPrint += `\n  ERROR: ${isPackageMalicious.categoryFriendlyName} - ${isPackageMalicious.message}`
+      } else {
+        for (const errorArray of result.errors) {
+          countErrors += errorArray.length
+          // Each error is actually an array of error objects
+          errorArray.forEach((error) => {
+            const messageText = error.message
+
+            // Rich formatting version
+            const topicRich = styleText(
+              ['red', 'bold'],
+              error.categoryFriendlyName.padEnd(maxTextLength, ' ')
+            )
+            const iconRich = styleText(['red', 'bold'], `✖`)
+            const wrappedMessage = wrapTextWithIndent(messageText, maxMessageWidth, indentString)
+            const errorLineRich = ` ${prefixRich} ${iconRich} ${topicRich} ${separatorRich} ${wrappedMessage} `
+            resultsForPrettyPrint += `\n${errorLineRich}`
+
+            // Plain text version
+            resultsForPlainTextPrint += `\n  ERROR: ${error.categoryFriendlyName} - ${messageText}`
+          })
+        }
+      }
+    }
+
+    // Display warnings with yellow color and ⚠ symbol
+    if (!isPackageMalicious && result.warnings && result.warnings.length > 0) {
+      result.warnings.forEach((warningArray) => {
+        countWarnings += warningArray.length
+        // Each warning is actually an array of warning objects
+        warningArray.forEach((warning) => {
+          const messageText = warning.message
+
+          // Rich formatting version
+          const topicRich = styleText(
+            ['yellow'],
+            warning.categoryFriendlyName.padEnd(maxTextLength, ' ')
+          )
+          const iconRich = styleText(['yellow', 'bold'], `⚠`)
+          const wrappedMessage = wrapTextWithIndent(messageText, maxMessageWidth, indentString)
+          const warningLineRich = ` ${prefixRich} ${iconRich} ${topicRich} ${separatorRich} ${wrappedMessage} `
+          resultsForPrettyPrint += `\n${warningLineRich}`
+
+          // Plain text version
+          resultsForPlainTextPrint += `\n  WARNING: ${warning.categoryFriendlyName} - ${messageText}`
+        })
+      })
+    }
+
+    // Close rich formatting box
+    resultsForPrettyPrint += `\n ${styleText(['dim'], '└─')}`
+  })
+
+  const maxTextLength = 'Total packages:'.length
+
+  // Rich formatting summary
+  summaryForPrettyPrint += `\n\n${styleText(['bold'], 'Summary:')}\n`
+  summaryForPrettyPrint += `\n - ${'Total packages:'.padEnd(maxTextLength, ' ')} ${styleText(
+    ['bold'],
+    String(countPackages)
+  )}`
+  summaryForPrettyPrint += `\n - ${'Total errors:'.padEnd(maxTextLength, ' ')} ${styleText(
+    ['red', 'bold'],
+    String(countErrors)
+  )}`
+  summaryForPrettyPrint += `\n - ${'Total warnings:'.padEnd(maxTextLength, ' ')} ${styleText(
+    ['yellow', 'bold'],
+    String(countWarnings)
+  )}`
+  summaryForPrettyPrint += `\n`
+
+  // Plain text summary
+  summaryForPlainTextPrint += `\n\nSummary:\n`
+  summaryForPlainTextPrint += `\n - Total packages: ${countPackages}`
+  summaryForPlainTextPrint += `\n - Total errors: ${countErrors}`
+  summaryForPlainTextPrint += `\n - Total warnings: ${countWarnings}`
+  summaryForPlainTextPrint += `\n`
+
+  return {
+    countErrors,
+    countWarnings,
+    resultsForPrettyPrint,
+    resultsForJSON,
+    resultsForPlainTextPrint,
+    summaryForPrettyPrint,
+    summaryForPlainTextPrint,
+    useRichFormatting
+  }
+}
+
+function marshallResultsToIssuesPerPackage(results) {
+  const issuesPerPackage = []
+  for (const pkg in results) {
+    const allMarshallResultsList = results[pkg]
+    const issues = {
+      pkg,
+      errors: [],
+      warnings: []
+    }
+    for (const marshall of allMarshallResultsList) {
+      for (const [key, value] of Object.entries(marshall)) {
+        if (value.errors && value.errors.length > 0) {
+          const marshallErrors = value.errors.map((error) => {
+            return {
+              marshall: value.marshall,
+              categoryId: value.categoryId,
+              categoryFriendlyName: marshallCategories[value.categoryId].title,
+              ...error
+            }
+          })
+          issues.errors.push(marshallErrors)
+        }
+        if (value.warnings && value.warnings.length > 0) {
+          const marshallWarnings = value.warnings.map((warning) => {
+            return {
+              marshall: value.marshall,
+              categoryId: value.categoryId,
+              categoryFriendlyName: marshallCategories[value.categoryId].title,
+              ...warning
+            }
+          })
+
+          issues.warnings.push(marshallWarnings)
+        }
+      }
+    }
+    if (issues.errors.length > 0 || issues.warnings.length > 0) {
+      issuesPerPackage.push(issues)
+    }
+  }
+
+  return issuesPerPackage
+}
+
+module.exports = { reportResults, marshallResultsToIssuesPerPackage }

package/lib/helpers/sourcePackages.js

@@ -0,0 +1,36 @@
+const path = require('node:path')
+const fs = require('node:fs/promises')
+
+async function getProjectPackages() {
+  const currentDirectory = process.cwd()
+
+  const packageJSONPath = path.join(currentDirectory, 'package.json')
+  try {
+    let packages = []
+    const packageJSON = await fs.readFile(packageJSONPath, 'utf-8')
+    const packageData = JSON.parse(packageJSON)
+    if (packageData && packageData.dependencies) {
+      packages = Object.keys(packageData.dependencies).map((dep) => {
+        return `${dep}@${packageData.dependencies[dep]}`
+      })
+    }
+
+    return packages
+  } catch (error) {
+    let errorMessage = ''
+    if (error.code === 'ENOENT') {
+      errorMessage = `No package.json found in ${currentDirectory}`
+    } else {
+      errorMessage = `Error reading package.json: ${error.message}`
+    }
+
+    return {
+      error: true,
+      message: errorMessage
+    }
+  }
+}
+
+module.exports = {
+  getProjectPackages
+}

package/lib/marshall.js

@@ -1,36 +1,65 @@
 /* eslint-disable no-console */
 'use strict'
 
-const color = require('kleur')
-
+// const util = require('node:util')
 const Marshalls = require('./marshalls')
 const PackageRepoUtils = require('./helpers/packageRepoUtils')
-
-const MESSAGE_TYPE = {
-  ERROR: 0,
-  WARNING: 1
-}
+// const { marshallCategories } = require('./marshalls/constants')
 
 class Marshall {
   constructor(options = {}) {
     this.pkgs = options ? options.pkgs : null
     this.packageRepoUtils = new PackageRepoUtils()
+    this.progressManager = options.progressManager || null
+    this.promiseThrottleHelper = options.promiseThrottleHelper || null
   }
 
-  process() {
+  async process() {
     // nothing to do? move on
     if (!this.pkgs) {
       return Promise.resolve()
     }
 
-    const config = {
-      pkgs: this.createPackageVersionMaps(this.pkgs),
-      packageRepoUtils: this.packageRepoUtils
+    if (this.progressManager) {
+      this.progressManager.update('Analyzing...')
     }
 
-    return Marshalls.tasks(config).then((ctx) => {
-      return this.report(ctx.marshalls)
+    const promises = this.pkgs.map((pkg) => {
+      if (!this.promiseThrottleHelper) {
+        return this.createPackageAuditFunction(pkg, this.packageRepoUtils)
+      } else {
+        // use the promise throttler to limit concurrency
+        return this.promiseThrottleHelper(
+          () => {
+            return this.createPackageAuditFunction(pkg, this.packageRepoUtils)
+          },
+          1,
+          50
+        ) // max 1 concurrent, 0.1 second delay
+      }
     })
+    const res = await Promise.all(promises)
+
+    // match pkgs array with results of promises
+    const promiseResultsPerPackage = this.pkgs.reduce((acc, pkg, index) => {
+      acc[pkg] = res[index]
+      return acc
+    }, {})
+
+    if (this.progressManager) {
+      this.progressManager.stop()
+    }
+
+    return promiseResultsPerPackage
+  }
+
+  async createPackageAuditFunction(pkg, packageRepoUtils) {
+    const allPackages = Array.isArray(pkg) ? pkg : [pkg]
+    const config = {
+      pkgs: this.createPackageVersionMaps(allPackages),
+      packageRepoUtils: packageRepoUtils
+    }
+    return Marshalls.tasks(config, this.progressManager)
   }
 
   createPackageVersionMaps(packages) {
@@ -52,58 +81,6 @@ class Marshall {
 
     return packageVersionMapping
   }
-
-  report(marshalls) {
-    const messages = this.collectPackageMessages(marshalls)
-
-    if (!messages || Object.keys(messages).length === 0) {
-      return { error: false }
-    }
-
-    console.log()
-    console.log('Detected possible issues with the following packages:')
-    for (const packageName in messages) {
-      const packageMessages = messages[packageName]
-      console.log(`  [${color.red(packageName)}]`)
-
-      packageMessages.forEach((message) => {
-        if (message.type === MESSAGE_TYPE.ERROR) {
-          console.log(`    - ${color.red(message.text)}`)
-        } else {
-          console.log(`    - ${color.yellow(message.text)}`)
-        }
-      })
-    }
-
-    return { error: true, data: messages }
-  }
-
-  collectPackageMessages(marshalls) {
-    const allPackageMessages = {}
-    for (const key in marshalls) {
-      this.prepareMessages(allPackageMessages, marshalls[key].errors)
-      this.prepareMessages(allPackageMessages, marshalls[key].warnings, true)
-    }
-
-    return allPackageMessages
-  }
-
-  prepareMessages(allPackageMessages, messages, isWarning) {
-    if (Array.isArray(messages) && messages.length > 0) {
-      messages.forEach((msg) => {
-        this.appendPackageMessage(allPackageMessages, msg.pkg, {
-          text: msg.message,
-          type: isWarning ? MESSAGE_TYPE.WARNING : MESSAGE_TYPE.ERROR
-        })
-      })
-    }
-  }
-
-  appendPackageMessage(packages, packageName, packageMessage) {
-    packages[packageName]
-      ? packages[packageName].push(packageMessage)
-      : (packages[packageName] = [packageMessage])
-  }
 }
 
 module.exports = Marshall