verdaccio-security-filter 1.0.6

package/build/lib/metrics.js

@@ -0,0 +1,202 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MetricsCollector = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/**
+ * Metrics collector for tracking security events
+ */
+class MetricsCollector {
+    constructor(config) {
+        this.metricsBuffer = [];
+        this.bufferSize = 100;
+        this.config = {
+            enabled: (config === null || config === void 0 ? void 0 : config.enabled) || false,
+            output: (config === null || config === void 0 ? void 0 : config.output) || 'stdout',
+            filePath: (config === null || config === void 0 ? void 0 : config.filePath) || './security-metrics.json',
+        };
+    }
+    /**
+     * Record a security event
+     */
+    record(event) {
+        if (!this.config.enabled) {
+            return;
+        }
+        this.metricsBuffer.push(event);
+        if (this.metricsBuffer.length >= this.bufferSize) {
+            this.flush();
+        }
+    }
+    /**
+     * Record a block event
+     */
+    recordBlock(packageName, version, reason, metadata) {
+        this.record({
+            timestamp: new Date().toISOString(),
+            event: 'block',
+            packageName,
+            version,
+            reason,
+            metadata,
+        });
+    }
+    /**
+     * Record a fallback event
+     */
+    recordFallback(packageName, fromVersion, toVersion, reason) {
+        this.record({
+            timestamp: new Date().toISOString(),
+            event: 'fallback',
+            packageName,
+            version: fromVersion,
+            reason,
+            metadata: { toVersion },
+        });
+    }
+    /**
+     * Record a publish rejection
+     */
+    recordPublishRejected(packageName, version, reason) {
+        this.record({
+            timestamp: new Date().toISOString(),
+            event: 'publish_rejected',
+            packageName,
+            version,
+            reason,
+        });
+    }
+    /**
+     * Record a CVE detection
+     */
+    recordCVE(packageName, version, cveId, severity) {
+        this.record({
+            timestamp: new Date().toISOString(),
+            event: 'cve_detected',
+            packageName,
+            version,
+            reason: `CVE ${cveId} (${severity})`,
+            metadata: { cveId, severity },
+        });
+    }
+    /**
+     * Record a license block
+     */
+    recordLicenseBlock(packageName, version, license, reason) {
+        this.record({
+            timestamp: new Date().toISOString(),
+            event: 'license_blocked',
+            packageName,
+            version,
+            reason,
+            metadata: { license },
+        });
+    }
+    /**
+     * Record a package-too-new event
+     */
+    recordPackageTooNew(packageName, version, reason, metadata) {
+        this.record({
+            timestamp: new Date().toISOString(),
+            event: 'package_too_new',
+            packageName,
+            version,
+            reason,
+            metadata,
+        });
+    }
+    /**
+     * Flush metrics buffer to output
+     */
+    flush() {
+        if (this.metricsBuffer.length === 0) {
+            return;
+        }
+        if (this.config.output === 'stdout') {
+            this.metricsBuffer.forEach(metric => {
+                console.log(JSON.stringify(metric));
+            });
+        }
+        else if (this.config.output === 'file' && this.config.filePath) {
+            this.writeToFile(this.metricsBuffer);
+        }
+        this.metricsBuffer = [];
+    }
+    /**
+     * Write metrics to file
+     */
+    writeToFile(metrics) {
+        try {
+            const filePath = this.config.filePath;
+            const dir = path.dirname(filePath);
+            // Ensure directory exists
+            if (!fs.existsSync(dir)) {
+                fs.mkdirSync(dir, { recursive: true });
+            }
+            // Append to file
+            const content = metrics.map(m => JSON.stringify(m)).join('\n') + '\n';
+            fs.appendFileSync(filePath, content, 'utf8');
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            console.error('[Security Filter] Failed to write metrics:', message);
+        }
+    }
+    /**
+     * Get metrics summary
+     */
+    getSummary() {
+        const summary = {
+            block: 0,
+            fallback: 0,
+            publish_rejected: 0,
+            cve_detected: 0,
+            license_blocked: 0,
+            package_too_new: 0,
+        };
+        this.metricsBuffer.forEach(metric => {
+            summary[metric.event] = (summary[metric.event] || 0) + 1;
+        });
+        return summary;
+    }
+    /**
+     * Cleanup - flush remaining metrics
+     */
+    cleanup() {
+        this.flush();
+    }
+}
+exports.MetricsCollector = MetricsCollector;

package/build/lib/package-age-checker.d.ts

@@ -0,0 +1,49 @@
+import { PackageAgeConfig } from '../types';
+import { Package } from '@verdaccio/types';
+/**
+ * Package age checker to protect against newly created malicious packages
+ */
+export declare class PackageAgeChecker {
+    private config;
+    constructor(config?: PackageAgeConfig);
+    /**
+     * Check if a package is old enough to be trusted
+     */
+    checkPackageAge(packageData: Package): {
+        allowed: boolean;
+        reason?: string;
+        ageDays?: number;
+        warnOnly?: boolean;
+    };
+    /**
+     * Check if a specific version is old enough to be trusted
+     */
+    checkVersionAge(packageData: Package, version: string): {
+        allowed: boolean;
+        reason?: string;
+        ageDays?: number;
+        warnOnly?: boolean;
+    };
+    /**
+     * Get package creation date from time field
+     * The 'created' field in package.time represents when the package was first published
+     */
+    private getPackageCreationDate;
+    /**
+     * Get version publish date from time field
+     */
+    private getVersionPublishDate;
+    /**
+     * Calculate age in days from a date
+     */
+    private calculateAgeDays;
+    /**
+     * Get summary of configuration
+     */
+    getSummary(): {
+        enabled: boolean;
+        minPackageAgeDays: number;
+        minVersionAgeDays?: number;
+        warnOnly: boolean;
+    };
+}

package/build/lib/package-age-checker.js

@@ -0,0 +1,138 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PackageAgeChecker = void 0;
+/**
+ * Package age checker to protect against newly created malicious packages
+ */
+class PackageAgeChecker {
+    constructor(config) {
+        var _a, _b, _c;
+        this.config = {
+            enabled: (_a = config === null || config === void 0 ? void 0 : config.enabled) !== null && _a !== void 0 ? _a : false,
+            minPackageAgeDays: (_b = config === null || config === void 0 ? void 0 : config.minPackageAgeDays) !== null && _b !== void 0 ? _b : 0,
+            minVersionAgeDays: config === null || config === void 0 ? void 0 : config.minVersionAgeDays,
+            warnOnly: (_c = config === null || config === void 0 ? void 0 : config.warnOnly) !== null && _c !== void 0 ? _c : false,
+        };
+    }
+    /**
+     * Check if a package is old enough to be trusted
+     */
+    checkPackageAge(packageData) {
+        if (!this.config.enabled) {
+            return { allowed: true };
+        }
+        // Get package creation date from time field
+        const createdDate = this.getPackageCreationDate(packageData);
+        if (!createdDate) {
+            // If we can't determine creation date, allow but warn
+            return {
+                allowed: true,
+                reason: 'Cannot determine package creation date',
+            };
+        }
+        const ageDays = this.calculateAgeDays(createdDate);
+        if (ageDays < this.config.minPackageAgeDays) {
+            const warnOnlyValue = this.config.warnOnly || false;
+            return {
+                allowed: warnOnlyValue,
+                reason: `Package is only ${ageDays} days old (minimum: ${this.config.minPackageAgeDays} days)`,
+                ageDays,
+                warnOnly: warnOnlyValue,
+            };
+        }
+        return { allowed: true, ageDays };
+    }
+    /**
+     * Check if a specific version is old enough to be trusted
+     */
+    checkVersionAge(packageData, version) {
+        if (!this.config.enabled || !this.config.minVersionAgeDays) {
+            return { allowed: true };
+        }
+        // Get version publish date from time field
+        const versionDate = this.getVersionPublishDate(packageData, version);
+        if (!versionDate) {
+            // If we can't determine version date, allow but warn
+            return {
+                allowed: true,
+                reason: `Cannot determine version ${version} publish date`,
+            };
+        }
+        const ageDays = this.calculateAgeDays(versionDate);
+        if (ageDays < this.config.minVersionAgeDays) {
+            const warnOnlyValue = this.config.warnOnly || false;
+            return {
+                allowed: warnOnlyValue,
+                reason: `Version ${version} is only ${ageDays} days old (minimum: ${this.config.minVersionAgeDays} days)`,
+                ageDays,
+                warnOnly: warnOnlyValue,
+            };
+        }
+        return { allowed: true, ageDays };
+    }
+    /**
+     * Get package creation date from time field
+     * The 'created' field in package.time represents when the package was first published
+     */
+    getPackageCreationDate(packageData) {
+        if (!packageData.time) {
+            return null;
+        }
+        // Try to get 'created' field first
+        if ('created' in packageData.time) {
+            const created = packageData.time.created;
+            if (typeof created === 'string') {
+                return new Date(created);
+            }
+        }
+        // Fallback: find the oldest version
+        const versions = Object.keys(packageData.time).filter(key => key !== 'modified' && key !== 'created');
+        if (versions.length === 0) {
+            return null;
+        }
+        const dates = versions
+            .map(v => {
+            const timeValue = packageData.time[v];
+            return typeof timeValue === 'string' ? new Date(timeValue) : null;
+        })
+            .filter((d) => d !== null);
+        if (dates.length === 0) {
+            return null;
+        }
+        // Return the oldest date
+        return new Date(Math.min(...dates.map(d => d.getTime())));
+    }
+    /**
+     * Get version publish date from time field
+     */
+    getVersionPublishDate(packageData, version) {
+        if (!packageData.time || !(version in packageData.time)) {
+            return null;
+        }
+        const timeValue = packageData.time[version];
+        if (typeof timeValue === 'string') {
+            return new Date(timeValue);
+        }
+        return null;
+    }
+    /**
+     * Calculate age in days from a date
+     */
+    calculateAgeDays(date) {
+        const now = new Date();
+        const diffMs = now.getTime() - date.getTime();
+        return Math.floor(diffMs / (1000 * 60 * 60 * 24));
+    }
+    /**
+     * Get summary of configuration
+     */
+    getSummary() {
+        return {
+            enabled: this.config.enabled,
+            minPackageAgeDays: this.config.minPackageAgeDays,
+            minVersionAgeDays: this.config.minVersionAgeDays,
+            warnOnly: this.config.warnOnly || false,
+        };
+    }
+}
+exports.PackageAgeChecker = PackageAgeChecker;

package/build/lib/whitelist-checker.d.ts

@@ -0,0 +1,48 @@
+import { WhitelistConfig } from '../types';
+/**
+ * Whitelist checker for package validation
+ */
+export declare class WhitelistChecker {
+    private config;
+    constructor(config?: WhitelistConfig);
+    /**
+     * Check if a package is whitelisted
+     */
+    isWhitelisted(packageName: string, version?: string): {
+        allowed: boolean;
+        reason?: string;
+    };
+    /**
+     * Check if package name matches any whitelist pattern
+     */
+    private matchesPattern;
+    /**
+     * Add package to whitelist
+     */
+    addPackage(packageName: string, versionRange?: string): void;
+    /**
+     * Remove package from whitelist
+     */
+    removePackage(packageName: string): void;
+    /**
+     * Add pattern to whitelist
+     */
+    addPattern(pattern: string): void;
+    /**
+     * Check if package meets auto-approve criteria
+     * Note: This is a placeholder. Real implementation would require
+     * integration with npm registry API to fetch download stats, etc.
+     */
+    meetsAutoApproveCriteria(_packageName: string): Promise<{
+        approved: boolean;
+        reason?: string;
+    }>;
+    /**
+     * Get whitelist summary
+     */
+    getSummary(): {
+        totalPackages: number;
+        totalPatterns: number;
+        hasAutoApprove: boolean;
+    };
+}

package/build/lib/whitelist-checker.js

@@ -0,0 +1,168 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WhitelistChecker = void 0;
+const semver = __importStar(require("semver"));
+/**
+ * Whitelist checker for package validation
+ */
+class WhitelistChecker {
+    constructor(config) {
+        this.config = {
+            packages: (config === null || config === void 0 ? void 0 : config.packages) || [],
+            patterns: (config === null || config === void 0 ? void 0 : config.patterns) || [],
+            versions: (config === null || config === void 0 ? void 0 : config.versions) || {},
+            autoApprove: config === null || config === void 0 ? void 0 : config.autoApprove,
+        };
+    }
+    /**
+     * Check if a package is whitelisted
+     */
+    isWhitelisted(packageName, version) {
+        // Check exact package name match
+        if (this.config.packages.includes(packageName)) {
+            // If version is specified, check version constraint
+            if (version && this.config.versions && packageName in this.config.versions) {
+                const versionRange = this.config.versions[packageName];
+                if (!semver.satisfies(version, versionRange)) {
+                    return {
+                        allowed: false,
+                        reason: `Version ${version} does not satisfy whitelist constraint ${versionRange}`,
+                    };
+                }
+            }
+            return { allowed: true };
+        }
+        // Check pattern match
+        if (this.matchesPattern(packageName)) {
+            return { allowed: true };
+        }
+        // Not in whitelist
+        return {
+            allowed: false,
+            reason: 'Package is not in whitelist',
+        };
+    }
+    /**
+     * Check if package name matches any whitelist pattern
+     */
+    matchesPattern(packageName) {
+        return this.config.patterns.some(pattern => {
+            try {
+                const regex = new RegExp(pattern);
+                return regex.test(packageName);
+            }
+            catch (_a) {
+                console.error(`[Whitelist] Invalid pattern: ${pattern}`);
+                return false;
+            }
+        });
+    }
+    /**
+     * Add package to whitelist
+     */
+    addPackage(packageName, versionRange) {
+        if (!this.config.packages.includes(packageName)) {
+            this.config.packages.push(packageName);
+        }
+        if (versionRange) {
+            this.config.versions = this.config.versions || {};
+            this.config.versions[packageName] = versionRange;
+        }
+    }
+    /**
+     * Remove package from whitelist
+     */
+    removePackage(packageName) {
+        const index = this.config.packages.indexOf(packageName);
+        if (index > -1) {
+            this.config.packages.splice(index, 1);
+        }
+        if (this.config.versions && packageName in this.config.versions) {
+            delete this.config.versions[packageName];
+        }
+    }
+    /**
+     * Add pattern to whitelist
+     */
+    addPattern(pattern) {
+        if (!this.config.patterns.includes(pattern)) {
+            this.config.patterns.push(pattern);
+        }
+    }
+    /**
+     * Check if package meets auto-approve criteria
+     * Note: This is a placeholder. Real implementation would require
+     * integration with npm registry API to fetch download stats, etc.
+     */
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    meetsAutoApproveCriteria(_packageName) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!this.config.autoApprove) {
+                return { approved: false, reason: 'Auto-approve not configured' };
+            }
+            // Placeholder for npm registry API integration
+            // In a real implementation, you would:
+            // 1. Fetch package info from npm registry
+            // 2. Check weekly downloads against minDownloads
+            // 3. Check GitHub stars against minStars
+            // 4. Check if publisher is verified
+            return {
+                approved: false,
+                reason: 'Auto-approve requires npm registry API integration (not implemented)',
+            };
+        });
+    }
+    /**
+     * Get whitelist summary
+     */
+    getSummary() {
+        return {
+            totalPackages: this.config.packages.length,
+            totalPatterns: this.config.patterns.length,
+            hasAutoApprove: !!this.config.autoApprove,
+        };
+    }
+}
+exports.WhitelistChecker = WhitelistChecker;