npq 3.8.1 → 3.9.0

package/lib/marshalls/provenance.marshall.js

@@ -1,5 +1,6 @@
 'use strict'
 
+const semver = require('semver')
 const BaseMarshall = require('./baseMarshall')
 const pacote = require('pacote')
 const Warning = require('../helpers/warning')
@@ -21,48 +22,166 @@ class Marshall extends BaseMarshall {
   validate(pkg) {
     const validationMetadata = {}
 
-    return this.packageRepoUtils
-      .getPackageInfo(pkg.packageName)
-      .then((packageInfo) => {
-        const packageName = packageInfo.name
-        const packageVersion =
-          pkg.packageVersion === 'latest'
-            ? packageInfo['dist-tags'] && packageInfo['dist-tags'].latest
-            : this.packageRepoUtils.parsePackageVersion(pkg.packageVersion).version
+    return (
+      this.packageRepoUtils
+        .getPackageInfo(pkg.packageName)
+        .then((packageInfo) => {
+          const packageName = packageInfo.name
+          const packageVersion =
+            pkg.packageVersion === 'latest'
+              ? packageInfo['dist-tags'] && packageInfo['dist-tags'].latest
+              : this.packageRepoUtils.parsePackageVersion(pkg.packageVersion).version
 
-        validationMetadata.name = packageName
-        validationMetadata.version = packageVersion
+          validationMetadata.name = packageName
+          validationMetadata.version = packageVersion
+          validationMetadata.packageInfo = packageInfo
 
-        if (!validationMetadata.version) {
-          throw new Error('Unable to find version or dist-tag for package')
-        }
-      })
-      .then(() => {
-        return this.fetchRegistryKeys()
-      })
-      .then((keys) => {
-        // @TODO currently we're hardcoding the official npm registry
-        // this should however allow for local proxies and other registries
-        return pacote.manifest(`${validationMetadata.name}@${validationMetadata.version}`, {
+          if (!validationMetadata.version) {
+            throw new Error('Unable to find version or dist-tag for package')
+          }
+        })
+        // Disabled for now, see notes in function due to slow performance for
+        // running this check
+        // .then(() => {
+        //   return this.checkProvenanceRegression(validationMetadata)
+        // })
+        .then(() => {
+          return this.fetchRegistryKeys()
+        })
+        .then((keys) => {
+          // @TODO currently we're hardcoding the official npm registry
+          // this should however allow for local proxies and other registries
+          return pacote.manifest(`${validationMetadata.name}@${validationMetadata.version}`, {
+            verifyAttestations: true,
+            registry: 'https://registry.npmjs.org',
+
+            '//registry.npmjs.org/:_keys': keys
+          })
+        })
+        .then((metadata) => {
+          if (!metadata || !metadata._attestations) {
+            throw new Warning('the package was published without any attestations')
+          }
+
+          const attestations = metadata._attestations
+
+          return attestations
+        })
+        .catch((error) => {
+          // We can ignore this type of error, false positive
+          // See: https://github.com/lirantal/npq/issues/329
+          if (
+            error.code === 'EATTESTATIONVERIFY' &&
+            error.message.includes('malformed checkpoint')
+          ) {
+            return []
+          } else {
+            if (error.message.includes('package was published without any attestations')) {
+              throw new Warning(`Unable to verify provenance: ${error.message}`)
+            } else {
+              this.debug(
+                '\nUnable to verify provenance for package %s@%s: %s',
+                validationMetadata.name,
+                validationMetadata.version,
+                error.message
+              )
+              throw new Warning(`Unable to verify provenance`)
+            }
+          }
+        })
+    )
+  }
+
+  /*
+  async checkProvenanceRegression(validationMetadata) {
+    const { packageInfo, name, version } = validationMetadata
+    
+    if (!packageInfo || !packageInfo.versions) {
+      return // Cannot check regression without version information
+    }
+
+    const allVersions = Object.keys(packageInfo.versions)
+    const validVersions = allVersions.filter(v => semver.valid(v))
+    
+    if (validVersions.length === 0) {
+      return // No valid versions to compare
+    }
+
+    // Get all versions older than the target version
+    const olderVersions = validVersions
+      .filter(v => semver.lt(v, version))
+      .sort(semver.rcompare) // Sort descending, newest first
+
+    if (olderVersions.length === 0) {
+      return // No older versions to check
+    }
+
+    // Check if any older versions had provenance
+    let hasProvenanceRegressionDetected = false
+    const versionWithProvenance = []
+
+    // NOTE: Going back all versions and fetching their manifest to check provenance
+    // is going to be very slow. We can limit this function to go back just 2-3 versions
+    // and then stop there
+    for (const olderVersion of olderVersions) {
+      try {
+        const keys = await this.fetchRegistryKeys()
+        const metadata = await pacote.manifest(`${name}@${olderVersion}`, {
           verifyAttestations: true,
           registry: 'https://registry.npmjs.org',
-
           '//registry.npmjs.org/:_keys': keys
         })
-      })
-      .then((metadata) => {
-        if (!metadata || !metadata._attestations) {
-          throw new Warning('the package was published without any attestations.')
+
+        if (metadata && metadata._attestations) {
+          versionWithProvenance.push(olderVersion)
+          hasProvenanceRegressionDetected = true
         }
+      } catch (error) {
+        // Ignore errors for older versions as they might not have provenance
+        // We only care if they successfully had provenance before
+        continue
+      }
+    }
 
-        const attestations = metadata._attestations
+    // If older versions had provenance, check if current version lacks it
+    if (hasProvenanceRegressionDetected) {
+      try {
+        const keys = await this.fetchRegistryKeys()
+        const currentMetadata = await pacote.manifest(`${name}@${version}`, {
+          verifyAttestations: true,
+          registry: 'https://registry.npmjs.org',
+          '//registry.npmjs.org/:_keys': keys
+        })
 
-        return attestations
-      })
-      .catch((error) => {
-        throw new Error(`Unable to verify provenance: ${error.message}`)
-      })
+        if (!currentMetadata || !currentMetadata._attestations) {
+          const latestVersionWithProvenance = versionWithProvenance[0] // First is the newest
+          throw new Error(
+            `Provenance regression detected: Previous version ${latestVersionWithProvenance} had provenance attestations, but version ${version} does not. This represents a security downgrade.`
+          )
+        }
+      } catch (error) {
+        // If it's our custom error, re-throw it
+        if (error.message.includes('Provenance regression detected')) {
+          throw error
+        }
+        
+        // If it's a verification error, the current version lacks valid provenance
+        if (error.code === 'EATTESTATIONVERIFY' || error.message.includes('attestations')) {
+          const latestVersionWithProvenance = versionWithProvenance[0]
+          throw new Error(
+            `Provenance regression detected: Previous version ${latestVersionWithProvenance} had provenance attestations, but version ${version} does not. This represents a security downgrade.`
+          )
+        }
+        
+        // For other errors, treat as if current version lacks provenance
+        const latestVersionWithProvenance = versionWithProvenance[0]
+        throw new Error(
+          `Provenance regression detected: Previous version ${latestVersionWithProvenance} had provenance attestations, but version ${version} does not. This represents a security downgrade.`
+        )
+      }
+    }
   }
+  */
 
   fetchRegistryKeys() {
     const registryHost = 'https://registry.npmjs.org'
@@ -86,7 +205,7 @@ class Marshall extends BaseMarshall {
         return keys
       })
       .catch((error) => {
-        throw new Error(`Error fetching registry keys: ${error.message}`)
+        throw new Warning(`Error fetching registry keys: ${error.message}`)
       })
   }
 }

package/lib/marshalls/repo.marshall.js

@@ -1,6 +1,7 @@
 'use strict'
 
 const BaseMarshall = require('./baseMarshall')
+const Warning = require('../helpers/warning')
 const { marshallCategories } = require('./constants')
 const URL = require('url').URL
 const MARSHALL_NAME = 'repo'
@@ -9,7 +10,7 @@ class Marshall extends BaseMarshall {
   constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
-    this.categoryId = marshallCategories.MalwareDetection.id
+    this.categoryId = marshallCategories.PackageHealth.id
   }
 
   title() {
@@ -30,21 +31,21 @@ class Marshall extends BaseMarshall {
           urlStructure = new URL(lastVersionData.repository.url)
           urlOfGitRepository = new URL(`https://${urlStructure.host}${urlStructure.pathname}`)
         } catch (error) {
-          throw new Error('No valid repository is associated with the package')
+          throw new Warning('No valid repository is associated with the package')
         }
         return fetch(urlOfGitRepository.href).catch(() => {
-          throw new Error(
+          throw new Warning(
             `The repository associated with the package (${urlOfGitRepository.href}) does not exist or is unreachable at the moment.`
           )
         })
       } else if (lastVersionData && lastVersionData.homepage) {
         return fetch(lastVersionData.homepage).catch(() => {
-          throw new Error(
+          throw new Warning(
             `The homepage associated with the package (${lastVersionData.homepage}) does not exist or is unreachable at the moment.`
           )
         })
       } else {
-        throw new Error('The package has no associated repository or homepage.')
+        throw new Warning('The package has no associated repository or homepage.')
       }
     })
   }

package/lib/marshalls/scripts.marshall.js

@@ -43,7 +43,7 @@ class Marshall extends BaseMarshall {
           packageScripts[scriptName].length > 0
         ) {
           throw new Error(
-            `Detected a possible malicious intent script, act carefully: ${scriptName}: ${packageScripts[scriptName]}`
+            `Detected a possible malicious intent script, audit required: ${scriptName}: ${packageScripts[scriptName]}`
           )
         }
       })

package/lib/marshalls/signatures.marshall.js

@@ -1,11 +1,15 @@
 'use strict'
 
 const BaseMarshall = require('./baseMarshall')
+const Warning = require('../helpers/warning')
+const util = require('util')
 const pacote = require('pacote')
 const { marshallCategories } = require('./constants')
 
 const MARSHALL_NAME = 'signatures'
 
+let registryKeysCache = null
+
 class Marshall extends BaseMarshall {
   constructor(options) {
     super(options)
@@ -20,6 +24,9 @@ class Marshall extends BaseMarshall {
   validate(pkg) {
     // @TODO currently we're hardcoding the official npm registry
     // this should however allow for local proxies and other registries
+    // @TODO performance improvement: we should cache the registry keys
+    // and not fetch them every time because they don't change between
+    // requests
     return this.fetchRegistryKeys()
       .then((keys) => {
         return pacote.manifest(`${pkg.packageName}@${pkg.packageVersion}`, {
@@ -33,11 +40,26 @@ class Marshall extends BaseMarshall {
         return metadata
       })
       .catch((error) => {
-        throw new Error(`Unable to grab package manifest: ${error.message}`)
+        // @TODO error.message that useful for rich debugging when enabled
+
+        if (
+          error.message &&
+          error.message.includes('but the corresponding public key has expired')
+        ) {
+          // if the error is about an expired key, we throw a warning
+          // instead of an error, so that the process can continue
+          throw new Warning(`Package is signed with an expired key`)
+        }
+
+        throw new Warning(`Unable to verify package signature on registry: ${error.message}`)
       })
   }
 
   fetchRegistryKeys() {
+    if (registryKeysCache) {
+      return Promise.resolve(registryKeysCache)
+    }
+
     const registryHost = 'https://registry.npmjs.org'
     const registryKeysEndpoint = '/-/npm/v1/keys'
 
@@ -56,10 +78,12 @@ class Marshall extends BaseMarshall {
         }))
       })
       .then((keys) => {
+        // save it in the cached singleton object
+        registryKeysCache = keys
         return keys
       })
       .catch((error) => {
-        throw new Error(`Error fetching registry keys: ${error.message}`)
+        throw new Warning(`Error fetching registry keys: ${error.message}`)
       })
   }
 }

package/lib/marshalls/snyk.marshall.js

@@ -8,7 +8,7 @@ const { marshallCategories } = require('./constants')
 
 const MARSHALL_NAME = 'snyk'
 const SNYK_API_URL = 'https://snyk.io/api/v1/vuln/npm'
-const SNYK_TEST_URL = 'https://snyk.io/test/npm'
+
 const SNYK_PACKAGE_PAGE = 'https://snyk.io/vuln/npm:'
 const SNYK_API_TOKEN = process.env.SNYK_TOKEN
 const SNYK_CONFIG_FILE = '.config/configstore/snyk.json'
@@ -53,34 +53,70 @@ class Marshall extends BaseMarshall {
         }
 
         if (data && data.issuesCount && data.issuesCount > 0) {
-          const packageSecurityInfo = `${SNYK_PACKAGE_PAGE}${encodeURIComponent(pkg.packageName)}`
-          throw new Error(`${data.issuesCount} vulnerable path(s) found: ${packageSecurityInfo}`)
+          if (this.snykApiToken) {
+            const packageSecurityInfo = `${SNYK_PACKAGE_PAGE}${encodeURIComponent(pkg.packageName)}`
+            if (data.isMaliciousPackage) {
+              throw new Error(`Malicious package found: ${packageSecurityInfo}`)
+            }
+
+            throw new Error(`${data.issuesCount} vulnerable path(s) found: ${packageSecurityInfo}`)
+          } else {
+            throw new Error(
+              `${data.issuesCount} vulnerabilities found by OSV for ${pkg.packageName}`
+            )
+          }
         }
 
         return data
       })
   }
 
-  getSnykVulnInfoUnauthenticated({ packageName, packageVersion }) {
-    const url = encodeURI(`${SNYK_TEST_URL}/${packageName}/${packageVersion}?type=json`)
+  getOsvVulnerabilityInfo({ packageName, packageVersion }) {
+    const url = 'https://api.osv.dev/v1/query'
+    const body = {
+      version: packageVersion,
+      package: {
+        name: packageName,
+        ecosystem: 'npm'
+      }
+    }
 
-    return fetch(url)
+    return fetch(url, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify(body)
+    })
       .then((response) => response.json())
       .then((data) => {
-        // format returned results the way that the
-        // official test API endpoint returns them in
-        if (data && data.hasOwnProperty('totalVulns')) {
+        if (data && data.vulns) {
+          const isMaliciousPackage = data.vulns.some(
+            (vuln) =>
+              vuln.database_specific &&
+              vuln.database_specific['malicious-packages-origins'] &&
+              vuln.database_specific['malicious-packages-origins'].length > 0
+          )
+
           return {
-            issuesCount: data.totalVulns
+            issuesCount: data.vulns.length,
+            isMaliciousPackage
           }
         }
+        return {
+          issuesCount: 0,
+          isMaliciousPackage: false
+        }
       })
-      .catch(() => false)
+      .catch(() => ({
+        issuesCount: 0,
+        isMaliciousPackage: false
+      }))
   }
 
   getSnykVulnInfo({ packageName, packageVersion } = {}) {
     if (!this.snykApiToken) {
-      return this.getSnykVulnInfoUnauthenticated({ packageName, packageVersion })
+      return this.getOsvVulnerabilityInfo({ packageName, packageVersion })
     }
 
     const url = `${SNYK_API_URL}/${encodeURIComponent(packageName + '@' + packageVersion)}`
@@ -90,17 +126,27 @@ class Marshall extends BaseMarshall {
         Authorization: `token ${this.snykApiToken}`
       }
     })
+      .then((response) => {
+        if (!response.ok) {
+          throw new Error(`Snyk API request failed with status ${response.status}`)
+        }
+        return response
+      })
       .then((response) => response.json())
       .then((data) => {
         if (data && data.vulnerabilities) {
+          const isMaliciousPackage = data.vulnerabilities.some(
+            (vulnerability) => vulnerability.title === 'Malicious Package'
+          )
+
           return {
-            issuesCount: data.vulnerabilities.length
+            issuesCount: data.vulnerabilities.length,
+            isMaliciousPackage
           }
         }
 
         return false
       })
-      .catch(() => false)
   }
 
   getSnykToken() {
@@ -112,7 +158,7 @@ class Marshall extends BaseMarshall {
 
     try {
       if (fs.statSync(snykConfigPath)) {
-        const snykConfig = require(snykConfigPath)
+        const snykConfig = JSON.parse(fs.readFileSync(snykConfigPath, 'utf8'))
         if (snykConfig && snykConfig.api) {
           return snykConfig.api
         }

package/lib/marshalls/typosquatting.marshall.js

@@ -4,7 +4,7 @@ const BaseMarshall = require('./baseMarshall')
 const { marshallCategories } = require('./constants')
 
 const path = require('path')
-const levenshtein = require('fast-levenshtein')
+const { distance } = require('fastest-levenshtein')
 const topPackagesRawJSON = require(path.join(__dirname, '../../data/top-packages.json'))
 
 const MARSHALL_NAME = 'typosquatting'
@@ -25,6 +25,11 @@ class Marshall extends BaseMarshall {
     let similarPackages = []
     let packageFoundInTopPackages = false
     return new Promise((resolve, reject) => {
+      // If package is within an allow-list
+      if (this.packageRepoUtils.isPackageInAllowList(pkg.packageName)) {
+        return resolve([])
+      }
+
       for (const popularPackageNameInRepository of topPackagesRawJSON) {
         // If the package to be installed is itself found within the Top Packages dataset
         // then we don't report on it
@@ -33,7 +38,7 @@ class Marshall extends BaseMarshall {
           return resolve([])
         }
 
-        levenshteinDistance = levenshtein.get(pkg.packageName, popularPackageNameInRepository)
+        levenshteinDistance = distance(pkg.packageName, popularPackageNameInRepository)
 
         if (levenshteinDistance > 0 && levenshteinDistance < 3) {
           similarPackages.push(popularPackageNameInRepository)
@@ -45,9 +50,7 @@ class Marshall extends BaseMarshall {
         const uniqueSimilarPackages = [...new Set(similarPackages)]
         return reject(
           new Error(
-            `Package name could be a typosquatting attempt for popular package(s): ${uniqueSimilarPackages.join(
-              ', '
-            )}`
+            `Potential typosquatting with popular package(s): ${uniqueSimilarPackages.join(', ')}`
           )
         )
       }

package/lib/marshalls/version-maturity.marshall.js

@@ -10,7 +10,7 @@ class Marshall extends BaseMarshall {
   constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
-    this.categoryId = marshallCategories.PackageHealth.id
+    this.categoryId = marshallCategories.SupplyChainSecurity.id
   }
 
   title() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "3.8.1",
+  "version": "3.9.0",
   "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",
@@ -24,7 +24,7 @@
     "prepare": "husky install"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=20.13.0"
   },
   "author": {
     "name": "Liran Tal",
@@ -39,6 +39,12 @@
     "provenance": true,
     "access": "public"
   },
+  "dependencies": {
+    "fastest-levenshtein": "^1.0.16",
+    "npm-package-arg": "^11.0.1",
+    "pacote": "^17.0.4",
+    "semver": "^7.7.2"
+  },
   "devDependencies": {
     "@babel/core": "^7.23.0",
     "@babel/plugin-transform-runtime": "^7.22.15",
@@ -66,10 +72,10 @@
     "collectCoverage": true,
     "coverageThreshold": {
       "global": {
-        "branches": 90,
-        "functions": 90,
-        "lines": 90,
-        "statements": 90
+        "branches": 80,
+        "functions": 80,
+        "lines": 80,
+        "statements": 80
       },
       "scripts/*": {
         "branches": 60,
@@ -78,6 +84,9 @@
         "statements": 80
       }
     },
+    "testMatch": [
+      "**/__tests__/**/*.test.js"
+    ],
     "testPathIgnorePatterns": [
       "/__tests__/__fixtures__/*"
     ]
@@ -127,7 +136,7 @@
       "node/no-unsupported-features": "off",
       "node/no-unpublished-require": "off",
       "security/detect-non-literal-fs-filename": "warn",
-      "security/detect-unsafe-regex": "error",
+      "security/detect-unsafe-regex": "warn",
       "security/detect-buffer-noassert": "error",
       "security/detect-child-process": "warn",
       "security/detect-disable-mustache-escape": "error",
@@ -169,18 +178,6 @@
       }
     }
   },
-  "dependencies": {
-    "fast-levenshtein": "^3.0.0",
-    "glob": "^10.3.10",
-    "inquirer": "^8.2.6",
-    "kleur": "^4.1.5",
-    "listr2": "^7.0.1",
-    "npm-package-arg": "^11.0.1",
-    "pacote": "^17.0.4",
-    "semver": "^7.5.4",
-    "validator": "13.11.0",
-    "yargs": "^17.7.2"
-  },
   "release": {
     "branches": [
       "main"

package/scripts/postinstall.js

@@ -1,8 +1,8 @@
 const fs = require('fs')
-const color = require('kleur')
-const inquirer = require('inquirer')
+const { styleText } = require('node:util')
 const semver = require('semver')
 
+const cliPrompt = require('../lib/helpers/cliPrompt.js')
 const helpers = require('./scriptHelpers')
 
 const runPostInstall = async () => {
@@ -35,24 +35,23 @@ const runPostInstall = async () => {
     console.log(
       'To do that, we can alias npm and yarn to npq, so that e.g. `npm install <package>` will first use npq to verify the package and prompt you if it finds any issues.'
     )
-    const answers = await inquirer.prompt([
-      {
-        type: 'confirm',
-        name: 'install',
-        message: `Do you want to add ${shellConfig.name} aliases for npm and yarn?`
-      }
-    ])
+    const answers = await cliPrompt.prompt({
+      name: 'install',
+      message: `Do you want to add ${shellConfig.name} aliases for npm and yarn?`,
+      default: true
+    })
+
     if (answers.install) {
       // eslint-disable-next-line security/detect-non-literal-fs-filename
       await fs.promises.appendFile(shellConfig.profilePath, shellConfig.aliases)
-      console.log(color.green('✔'), 'Reload your shell profile to use npq!')
+      console.log(styleText('green', '✔'), 'Reload your shell profile to use npq!')
     }
   } catch (err) {
     if (err.isTtyError) {
       // Could not render inquirer prompt; abort auto-install
       return
     }
-    console.error(color.red('Failed to add aliases: '), err)
+    console.error(styleText('red', 'Failed to add aliases: '), err)
   }
 }