scan-compromised 1.0.21 → 1.1.0

package/README.md

@@ -2,6 +2,8 @@
 
 🔍 A CLI tool to detect known compromised npm packages in your project.
 
+**No third-party dependencies:** This tool is fully self-contained and does not rely on any external npm packages or libraries. You can use it with confidence in sensitive or locked-down environments.
+
 This scanner checks your `package.json`, `package-lock.json`, `yarn.lock`, and `pnpm-lock.yaml` files for any packages that were compromised in recent supply chain attacks — including the September 2025 Shai-Hulud incident.
 
 It flags:
@@ -12,7 +14,7 @@ It flags:
 
 ## 🚀 Installation
 
-### Run directly with `npx` (no install)
+### Recommended: Run directly with `npx` (no install)
 ```bash
 npx scan-compromised
 ```
@@ -22,10 +24,21 @@ npm install -g scan-compromised
 scan-compromised
 ```
 ## 📦 Usage
+
 ### Basic scan
 ```bash
 scan-compromised
 ```
+
+### Hard gate: block installs with known advisories
+Add this to your project's `preinstall` script in `package.json`:
+```json
+"scripts": {
+  "preinstall": "npx scan-compromised"
+}
+```
+This will prevent installation of any dependencies with known advisories, acting as a hard gate in your supply chain.
+
 ### JSON output (for CI integration)
 ```bash
 scan-compromised --json

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scan-compromised",
-  "version": "1.0.21",
+  "version": "1.1.0",
   "description": "A simple npm CLI tool (starter template)",
   "main": "scripts/index.js",
   "type": "module",

package/scripts/index.js

@@ -4,6 +4,7 @@ import { join, isAbsolute, dirname } from "path";
 import { fileURLToPath } from "url";
 import util from "util";
 import CONFIG from "../config/config.js";
+import { logToRoot } from "./logger.js";
 
 // Create a debug logger for the "threats" namespace
 const debug = util.debuglog("threats");
@@ -272,15 +273,18 @@ function scanPnpmLock(content, bad) {
   debug("Bad findings: %d, Warn findings: %d", badFindings.length, warnFindings.length);
 
   warnFindings.forEach(f =>
-    console.log(`⚠️  WARNING: ${f.pkg}@${f.version} in ${f.file} (${f.where}) — package was targeted in past attack, but version is not flagged as malicious`)
+    logToRoot(`WARNING: ${f.pkg}@${f.version} in ${f.file} (${f.where}) — package had previous vulnerability, but version is not flagged with advisory.`)
   );
 
-  badFindings.forEach(f =>
-    console.log(`❌ ALERT: ${f.pkg}@${f.version} in ${f.file} (${f.where}) — known malicious version`)
-  );
+  badFindings.forEach(f => {
+    console.log(`❌ ALERT: ${f.pkg}@${f.version} in ${f.file} (${f.where}) — known advisory`);
+    logToRoot(`ALERT: ${f.pkg}@${f.version} in ${f.file} (${f.where}) — known advisory`);
+  });
 
   if (badFindings.length === 0) {
-    console.log("✅ No known malicious versions detected.");
+    console.log("✅ No known advisories detected.");
+    logToRoot("No known advisories detected.");
+    console.log("Scan completed, results can be found in scan-compromised.log");
   } else {
     debug("Exiting with code 1 due to bad findings");
     process.exit(1);