scan-compromised 1.0.21 → 1.1.1

package/README.md

@@ -2,6 +2,8 @@
 
 🔍 A CLI tool to detect known compromised npm packages in your project.
 
+**No third-party dependencies:** This tool is fully self-contained and does not rely on any external npm packages or libraries. You can use it with confidence in sensitive or locked-down environments.
+
 This scanner checks your `package.json`, `package-lock.json`, `yarn.lock`, and `pnpm-lock.yaml` files for any packages that were compromised in recent supply chain attacks — including the September 2025 Shai-Hulud incident.
 
 It flags:
@@ -12,7 +14,7 @@ It flags:
 
 ## 🚀 Installation
 
-### Run directly with `npx` (no install)
+### Recommended: Run directly with `npx` (no install)
 ```bash
 npx scan-compromised
 ```
@@ -22,10 +24,21 @@ npm install -g scan-compromised
 scan-compromised
 ```
 ## 📦 Usage
+
 ### Basic scan
 ```bash
 scan-compromised
 ```
+
+### Hard gate: block installs with known advisories
+Add this to your project's `preinstall` script in `package.json`:
+```json
+"scripts": {
+  "preinstall": "npx scan-compromised"
+}
+```
+This will prevent installation of any dependencies with known advisories, acting as a hard gate in your supply chain.
+
 ### JSON output (for CI integration)
 ```bash
 scan-compromised --json

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scan-compromised",
-  "version": "1.0.21",
+  "version": "1.1.1",
   "description": "A simple npm CLI tool (starter template)",
   "main": "scripts/index.js",
   "type": "module",
@@ -13,6 +13,7 @@
   },
   "files": [
     "scripts/index.js",
+    "scripts/logger.js",
     "data/threats.json",
     "config/config.js"
   ],

package/scripts/index.js

@@ -4,6 +4,7 @@ import { join, isAbsolute, dirname } from "path";
 import { fileURLToPath } from "url";
 import util from "util";
 import CONFIG from "../config/config.js";
+import { logToRoot } from "./logger.js";
 
 // Create a debug logger for the "threats" namespace
 const debug = util.debuglog("threats");
@@ -272,15 +273,18 @@ function scanPnpmLock(content, bad) {
   debug("Bad findings: %d, Warn findings: %d", badFindings.length, warnFindings.length);
 
   warnFindings.forEach(f =>
-    console.log(`⚠️  WARNING: ${f.pkg}@${f.version} in ${f.file} (${f.where}) — package was targeted in past attack, but version is not flagged as malicious`)
+    logToRoot(`WARNING: ${f.pkg}@${f.version} in ${f.file} (${f.where}) — package had previous vulnerability, but version is not flagged with advisory.`)
   );
 
-  badFindings.forEach(f =>
-    console.log(`❌ ALERT: ${f.pkg}@${f.version} in ${f.file} (${f.where}) — known malicious version`)
-  );
+  badFindings.forEach(f => {
+    console.log(`❌ ALERT: ${f.pkg}@${f.version} in ${f.file} (${f.where}) — known advisory`);
+    logToRoot(`ALERT: ${f.pkg}@${f.version} in ${f.file} (${f.where}) — known advisory`);
+  });
 
   if (badFindings.length === 0) {
-    console.log("✅ No known malicious versions detected.");
+    console.log("✅ No known advisories detected.");
+    logToRoot("No known advisories detected.");
+    console.log("Scan completed, results can be found in scan-compromised.log");
   } else {
     debug("Exiting with code 1 due to bad findings");
     process.exit(1);

package/scripts/logger.js

@@ -0,0 +1,31 @@
+import { appendFileSync, existsSync } from 'node:fs';
+import { resolve, dirname, join, parse } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+/**
+ * Walk up from a starting directory until we find a package.json,
+ * then return that directory as the project root.
+ */
+function findProjectRoot(startDir = dirname(fileURLToPath(import.meta.url))) {
+  let dir = startDir;
+  while (dir !== parse(dir).root) {
+    if (existsSync(join(dir, 'package.json'))) {
+      return dir;
+    }
+    dir = dirname(dir);
+  }
+  return process.cwd(); // fallback
+}
+
+const projectRoot = findProjectRoot();
+const logFilePath = resolve(projectRoot, 'scan-compromised.log');
+
+/**
+ * Append a message to scan-compromised.log in the project root.
+ * @param {string} message - The text to log.
+ */
+export function logToRoot(message) {
+  const timestamp = new Date().toISOString();
+  const entry = `[${timestamp}] ${message}\n`;
+  appendFileSync(logFilePath, entry, { encoding: 'utf8' });
+}