verdaccio-security-filter 1.0.6

package/build/lib/cve-checker.d.ts

@@ -0,0 +1,43 @@
+import { CVECheckConfig, CVECheckResult } from '../types';
+/**
+ * CVE Checker that integrates with vulnerability databases
+ */
+export declare class CVEChecker {
+    private config;
+    private cache;
+    private lastUpdate;
+    constructor(config?: CVECheckConfig);
+    /**
+     * Check if a package version has known vulnerabilities
+     */
+    checkPackage(packageName: string, version: string): Promise<CVECheckResult>;
+    /**
+     * Fetch vulnerabilities from configured databases
+     */
+    private fetchVulnerabilities;
+    /**
+     * Fetch vulnerabilities from OSV (Open Source Vulnerabilities) database
+     * https://osv.dev/
+     */
+    private fetchFromOSV;
+    /**
+     * Map OSV severity to our severity levels
+     */
+    private mapOSVSeverity;
+    /**
+     * Check if cache is stale
+     */
+    private isCacheStale;
+    /**
+     * Load cache from disk
+     */
+    private loadCache;
+    /**
+     * Save cache to disk
+     */
+    private saveCache;
+    /**
+     * Clear cache
+     */
+    clearCache(): void;
+}

package/build/lib/cve-checker.js

@@ -0,0 +1,256 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CVEChecker = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/**
+ * CVE Checker that integrates with vulnerability databases
+ */
+class CVEChecker {
+    constructor(config) {
+        this.cache = new Map();
+        this.lastUpdate = 0;
+        this.config = {
+            enabled: (config === null || config === void 0 ? void 0 : config.enabled) || false,
+            databases: (config === null || config === void 0 ? void 0 : config.databases) || ['osv'],
+            severity: (config === null || config === void 0 ? void 0 : config.severity) || ['high', 'critical'],
+            autoBlock: (config === null || config === void 0 ? void 0 : config.autoBlock) || false,
+            updateInterval: (config === null || config === void 0 ? void 0 : config.updateInterval) || 24,
+            cacheDir: (config === null || config === void 0 ? void 0 : config.cacheDir) || './.security-cache',
+        };
+        if (this.config.enabled) {
+            this.loadCache();
+        }
+    }
+    /**
+     * Check if a package version has known vulnerabilities
+     */
+    checkPackage(packageName, version) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!this.config.enabled) {
+                return {
+                    package: packageName,
+                    version,
+                    vulnerabilities: [],
+                    isVulnerable: false,
+                    checkedAt: new Date().toISOString(),
+                };
+            }
+            const cacheKey = `${packageName}@${version}`;
+            // Check cache first
+            if (this.cache.has(cacheKey) && !this.isCacheStale()) {
+                return this.cache.get(cacheKey);
+            }
+            // Fetch from databases
+            const vulnerabilities = yield this.fetchVulnerabilities(packageName, version);
+            // Filter by configured severity
+            const filteredVulnerabilities = vulnerabilities.filter(vuln => this.config.severity.includes(vuln.severity));
+            const result = {
+                package: packageName,
+                version,
+                vulnerabilities: filteredVulnerabilities,
+                isVulnerable: filteredVulnerabilities.length > 0,
+                checkedAt: new Date().toISOString(),
+            };
+            // Cache result
+            this.cache.set(cacheKey, result);
+            this.saveCache();
+            return result;
+        });
+    }
+    /**
+     * Fetch vulnerabilities from configured databases
+     */
+    fetchVulnerabilities(packageName, version) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const vulnerabilities = [];
+            for (const database of this.config.databases) {
+                try {
+                    switch (database) {
+                        case 'osv':
+                            vulnerabilities.push(...yield this.fetchFromOSV(packageName, version));
+                            break;
+                        case 'snyk':
+                            // Snyk integration would go here (requires API key)
+                            break;
+                        case 'github':
+                            // GitHub Advisory Database integration would go here
+                            break;
+                    }
+                }
+                catch (error) {
+                    const message = error instanceof Error ? error.message : String(error);
+                    console.error(`[CVE Checker] Error fetching from ${database}:`, message);
+                }
+            }
+            return vulnerabilities;
+        });
+    }
+    /**
+     * Fetch vulnerabilities from OSV (Open Source Vulnerabilities) database
+     * https://osv.dev/
+     */
+    fetchFromOSV(packageName, version) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const response = yield fetch('https://api.osv.dev/v1/query', {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/json',
+                    },
+                    body: JSON.stringify({
+                        package: {
+                            name: packageName,
+                            ecosystem: 'npm',
+                        },
+                        version: version,
+                    }),
+                });
+                if (!response.ok) {
+                    throw new Error(`OSV API returned ${response.status}`);
+                }
+                const data = yield response.json();
+                if (!data.vulns || data.vulns.length === 0) {
+                    return [];
+                }
+                return data.vulns.map((vuln) => {
+                    var _a, _b, _c, _d, _e, _f, _g;
+                    return ({
+                        id: vuln.id,
+                        severity: this.mapOSVSeverity(vuln.severity),
+                        summary: vuln.summary || vuln.details || 'No description available',
+                        affectedVersions: ((_a = vuln.affected) === null || _a === void 0 ? void 0 : _a.map((a) => { var _a; return (_a = a.ranges) === null || _a === void 0 ? void 0 : _a.map((r) => { var _a; return (_a = r.events) === null || _a === void 0 ? void 0 : _a.map((e) => e.introduced || e.fixed).filter(Boolean); }).flat(); }).flat()) || [],
+                        fixedVersion: (_g = (_f = (_e = (_d = (_c = (_b = vuln.affected) === null || _b === void 0 ? void 0 : _b[0]) === null || _c === void 0 ? void 0 : _c.ranges) === null || _d === void 0 ? void 0 : _d[0]) === null || _e === void 0 ? void 0 : _e.events) === null || _f === void 0 ? void 0 : _f.find((e) => e.fixed)) === null || _g === void 0 ? void 0 : _g.fixed,
+                        publishedDate: vuln.published || new Date().toISOString(),
+                        source: 'osv',
+                    });
+                });
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                console.error('[CVE Checker] OSV API error:', message);
+                return [];
+            }
+        });
+    }
+    /**
+     * Map OSV severity to our severity levels
+     */
+    mapOSVSeverity(osvSeverity) {
+        if (!osvSeverity || osvSeverity.length === 0) {
+            return 'medium';
+        }
+        // OSV uses CVSS scores
+        const severity = osvSeverity[0];
+        if (severity.type === 'CVSS_V3') {
+            const score = parseFloat(severity.score);
+            if (score >= 9.0)
+                return 'critical';
+            if (score >= 7.0)
+                return 'high';
+            if (score >= 4.0)
+                return 'medium';
+            return 'low';
+        }
+        return 'medium';
+    }
+    /**
+     * Check if cache is stale
+     */
+    isCacheStale() {
+        const now = Date.now();
+        const updateIntervalMs = this.config.updateInterval * 60 * 60 * 1000;
+        return now - this.lastUpdate > updateIntervalMs;
+    }
+    /**
+     * Load cache from disk
+     */
+    loadCache() {
+        try {
+            const cacheFile = path.join(this.config.cacheDir, 'cve-cache.json');
+            if (fs.existsSync(cacheFile)) {
+                const data = fs.readFileSync(cacheFile, 'utf8');
+                const parsed = JSON.parse(data);
+                this.cache = new Map(Object.entries(parsed.cache));
+                this.lastUpdate = parsed.lastUpdate || 0;
+            }
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            console.error('[CVE Checker] Failed to load cache:', message);
+        }
+    }
+    /**
+     * Save cache to disk
+     */
+    saveCache() {
+        try {
+            const cacheFile = path.join(this.config.cacheDir, 'cve-cache.json');
+            const dir = path.dirname(cacheFile);
+            if (!fs.existsSync(dir)) {
+                fs.mkdirSync(dir, { recursive: true });
+            }
+            const data = {
+                cache: Object.fromEntries(this.cache),
+                lastUpdate: Date.now(),
+            };
+            fs.writeFileSync(cacheFile, JSON.stringify(data, null, 2), 'utf8');
+            this.lastUpdate = Date.now();
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            console.error('[CVE Checker] Failed to save cache:', message);
+        }
+    }
+    /**
+     * Clear cache
+     */
+    clearCache() {
+        this.cache.clear();
+        this.lastUpdate = 0;
+        this.saveCache();
+    }
+}
+exports.CVEChecker = CVEChecker;

package/build/lib/license-checker.d.ts

@@ -0,0 +1,37 @@
+import { LicenseConfig } from '../types';
+import { Version } from '@verdaccio/types';
+/**
+ * License checker for validating package licenses
+ */
+export declare class LicenseChecker {
+    private config;
+    constructor(config?: LicenseConfig);
+    /**
+     * Check if a package version's license is allowed
+     */
+    checkLicense(versionData: Version): {
+        allowed: boolean;
+        reason?: string;
+        license?: string;
+    };
+    /**
+     * Extract license from version data
+     */
+    private extractLicense;
+    /**
+     * Check if license is blocked
+     */
+    private isLicenseBlocked;
+    /**
+     * Check if license is allowed
+     */
+    private isLicenseAllowed;
+    /**
+     * Get common open source licenses
+     */
+    static getCommonOpenSourceLicenses(): string[];
+    /**
+     * Get common copyleft licenses
+     */
+    static getCopyleftLicenses(): string[];
+}

package/build/lib/license-checker.js

@@ -0,0 +1,124 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LicenseChecker = void 0;
+/**
+ * License checker for validating package licenses
+ */
+class LicenseChecker {
+    constructor(config) {
+        this.config = {
+            allowed: (config === null || config === void 0 ? void 0 : config.allowed) || [],
+            blocked: (config === null || config === void 0 ? void 0 : config.blocked) || [],
+            requireLicense: (config === null || config === void 0 ? void 0 : config.requireLicense) !== false,
+        };
+    }
+    /**
+     * Check if a package version's license is allowed
+     */
+    checkLicense(versionData) {
+        const license = this.extractLicense(versionData);
+        // Check if license is missing
+        if (!license || license === 'UNLICENSED' || license === '') {
+            if (this.config.requireLicense) {
+                return {
+                    allowed: false,
+                    reason: 'Package does not specify a license',
+                    license: license || 'none',
+                };
+            }
+            return { allowed: true };
+        }
+        // Check blocked list
+        if (this.isLicenseBlocked(license)) {
+            return {
+                allowed: false,
+                reason: `License '${license}' is in blocked list`,
+                license,
+            };
+        }
+        // Check allowed list (if specified)
+        if (this.config.allowed.length > 0 && !this.isLicenseAllowed(license)) {
+            return {
+                allowed: false,
+                reason: `License '${license}' is not in allowed list`,
+                license,
+            };
+        }
+        return { allowed: true, license };
+    }
+    /**
+     * Extract license from version data
+     */
+    extractLicense(versionData) {
+        if (!versionData.license) {
+            return null;
+        }
+        // Handle string license
+        if (typeof versionData.license === 'string') {
+            return versionData.license;
+        }
+        // Handle SPDX license object
+        if (typeof versionData.license === 'object' && 'type' in versionData.license) {
+            return versionData.license.type;
+        }
+        return null;
+    }
+    /**
+     * Check if license is blocked
+     */
+    isLicenseBlocked(license) {
+        return this.config.blocked.some(blocked => {
+            // Exact match
+            if (blocked === license) {
+                return true;
+            }
+            // Handle SPDX expressions (e.g., "MIT OR Apache-2.0")
+            const licenseTokens = license.split(/\s+(?:OR|AND)\s+/i);
+            return licenseTokens.some(token => token.trim() === blocked);
+        });
+    }
+    /**
+     * Check if license is allowed
+     */
+    isLicenseAllowed(license) {
+        return this.config.allowed.some(allowed => {
+            // Exact match
+            if (allowed === license) {
+                return true;
+            }
+            // Handle SPDX expressions (e.g., "MIT OR Apache-2.0")
+            const licenseTokens = license.split(/\s+(?:OR|AND)\s+/i);
+            return licenseTokens.some(token => token.trim() === allowed);
+        });
+    }
+    /**
+     * Get common open source licenses
+     */
+    static getCommonOpenSourceLicenses() {
+        return [
+            'MIT',
+            'Apache-2.0',
+            'BSD-2-Clause',
+            'BSD-3-Clause',
+            'ISC',
+            '0BSD',
+            'CC0-1.0',
+            'Unlicense',
+        ];
+    }
+    /**
+     * Get common copyleft licenses
+     */
+    static getCopyleftLicenses() {
+        return [
+            'GPL-2.0',
+            'GPL-3.0',
+            'AGPL-3.0',
+            'LGPL-2.1',
+            'LGPL-3.0',
+            'MPL-2.0',
+            'EPL-2.0',
+        ];
+    }
+}
+exports.LicenseChecker = LicenseChecker;

package/build/lib/logger.d.ts

@@ -0,0 +1,42 @@
+import { Logger } from '@verdaccio/types';
+import { LoggerConfig } from '../types';
+/**
+ * Enhanced logger wrapper with configurable log levels and formatting
+ */
+export declare class SecurityLogger {
+    private verdaccioLogger;
+    private config;
+    private readonly prefix;
+    constructor(verdaccioLogger: Logger, config?: LoggerConfig);
+    private shouldLog;
+    private formatMessage;
+    trace(message: string, ...args: any[]): void;
+    debug(message: string, ...args: any[]): void;
+    info(message: string, ...args: any[]): void;
+    warn(message: string, ...args: any[]): void;
+    error(message: string, ...args: any[]): void;
+    /**
+     * Log package blocking event
+     */
+    logBlock(packageName: string, version: string, reason: string): void;
+    /**
+     * Log fallback event
+     */
+    logFallback(packageName: string, fromVersion: string, toVersion: string, reason?: string): void;
+    /**
+     * Log CVE detection
+     */
+    logCVE(packageName: string, version: string, cveId: string, severity: string): void;
+    /**
+     * Log license violation
+     */
+    logLicense(packageName: string, version: string, license: string, reason: string): void;
+    /**
+     * Log publish rejection
+     */
+    logPublishRejected(packageName: string, version: string, reason: string): void;
+    /**
+     * Log initialization
+     */
+    logInit(features: string[]): void;
+}

package/build/lib/logger.js

@@ -0,0 +1,95 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecurityLogger = void 0;
+/**
+ * Enhanced logger wrapper with configurable log levels and formatting
+ */
+class SecurityLogger {
+    constructor(verdaccioLogger, config) {
+        this.prefix = '[Security Filter]';
+        this.verdaccioLogger = verdaccioLogger;
+        this.config = {
+            level: (config === null || config === void 0 ? void 0 : config.level) || 'info',
+            enabled: (config === null || config === void 0 ? void 0 : config.enabled) !== false,
+            includeTimestamp: (config === null || config === void 0 ? void 0 : config.includeTimestamp) !== false,
+        };
+    }
+    shouldLog(level) {
+        if (!this.config.enabled) {
+            return false;
+        }
+        const levels = ['trace', 'debug', 'info', 'warn', 'error'];
+        const configLevel = levels.indexOf(this.config.level);
+        const messageLevel = levels.indexOf(level);
+        return messageLevel >= configLevel;
+    }
+    formatMessage(message) {
+        const timestamp = this.config.includeTimestamp
+            ? `[${new Date().toISOString()}] `
+            : '';
+        return `${timestamp}${this.prefix} ${message}`;
+    }
+    trace(message, ...args) {
+        if (this.shouldLog('trace')) {
+            this.verdaccioLogger.trace(this.formatMessage(message), ...args);
+        }
+    }
+    debug(message, ...args) {
+        if (this.shouldLog('debug')) {
+            this.verdaccioLogger.debug(this.formatMessage(message), ...args);
+        }
+    }
+    info(message, ...args) {
+        if (this.shouldLog('info')) {
+            this.verdaccioLogger.info(this.formatMessage(message), ...args);
+        }
+    }
+    warn(message, ...args) {
+        if (this.shouldLog('warn')) {
+            this.verdaccioLogger.warn(this.formatMessage(message), ...args);
+        }
+    }
+    error(message, ...args) {
+        if (this.shouldLog('error')) {
+            this.verdaccioLogger.error(this.formatMessage(message), ...args);
+        }
+    }
+    /**
+     * Log package blocking event
+     */
+    logBlock(packageName, version, reason) {
+        this.warn(`Blocked ${packageName}@${version} - ${reason}`);
+    }
+    /**
+     * Log fallback event
+     */
+    logFallback(packageName, fromVersion, toVersion, reason) {
+        const reasonText = reason ? ` (${reason})` : '';
+        this.info(`Fallback applied: ${packageName}@${fromVersion} -> ${toVersion}${reasonText}`);
+    }
+    /**
+     * Log CVE detection
+     */
+    logCVE(packageName, version, cveId, severity) {
+        this.warn(`CVE detected: ${cveId} [${severity}] in ${packageName}@${version}`);
+    }
+    /**
+     * Log license violation
+     */
+    logLicense(packageName, version, license, reason) {
+        this.warn(`License violation: ${packageName}@${version} has ${license} - ${reason}`);
+    }
+    /**
+     * Log publish rejection
+     */
+    logPublishRejected(packageName, version, reason) {
+        this.warn(`Publish rejected: ${packageName}@${version} - ${reason}`);
+    }
+    /**
+     * Log initialization
+     */
+    logInit(features) {
+        this.info(`Plugin initialized with features: ${features.join(', ')}`);
+    }
+}
+exports.SecurityLogger = SecurityLogger;

package/build/lib/metrics.d.ts

@@ -0,0 +1,54 @@
+import { MetricsConfig, MetricsData } from '../types';
+/**
+ * Metrics collector for tracking security events
+ */
+export declare class MetricsCollector {
+    private config;
+    private metricsBuffer;
+    private readonly bufferSize;
+    constructor(config?: MetricsConfig);
+    /**
+     * Record a security event
+     */
+    record(event: MetricsData): void;
+    /**
+     * Record a block event
+     */
+    recordBlock(packageName: string, version: string, reason: string, metadata?: Record<string, any>): void;
+    /**
+     * Record a fallback event
+     */
+    recordFallback(packageName: string, fromVersion: string, toVersion: string, reason: string): void;
+    /**
+     * Record a publish rejection
+     */
+    recordPublishRejected(packageName: string, version: string, reason: string): void;
+    /**
+     * Record a CVE detection
+     */
+    recordCVE(packageName: string, version: string, cveId: string, severity: string): void;
+    /**
+     * Record a license block
+     */
+    recordLicenseBlock(packageName: string, version: string, license: string, reason: string): void;
+    /**
+     * Record a package-too-new event
+     */
+    recordPackageTooNew(packageName: string, version: string, reason: string, metadata?: Record<string, any>): void;
+    /**
+     * Flush metrics buffer to output
+     */
+    flush(): void;
+    /**
+     * Write metrics to file
+     */
+    private writeToFile;
+    /**
+     * Get metrics summary
+     */
+    getSummary(): Record<string, number>;
+    /**
+     * Cleanup - flush remaining metrics
+     */
+    cleanup(): void;
+}