verdaccio-security-filter 1.2.0 → 1.3.0

package/README.md

@@ -71,6 +71,13 @@ This plugin implements **two independent security layers** for complete protecti
   - **Minimum Package Age** - Require packages to exist for a minimum number of days
   - **Minimum Version Age** - Require specific versions to exist for a minimum number of days
   - **Warn-Only Mode** - Log warnings without blocking
+- **Author Filtering** - Block packages based on author information
+  - **Block by Author Name** - Block specific author names or patterns
+  - **Block by Email** - Block specific email addresses or patterns
+  - **Block by Email Domain** - Block entire email domains (e.g., `.ru`, `yandex.ru`)
+  - **Block by Region** - Block authors from specific regions based on email domains
+  - **Maintainer & Contributor Checking** - Validates all package maintainers and contributors
+  - **Warn-Only Mode** - Log warnings without blocking
 - **Middleware Interception** - HTTP middleware that blocks tarball downloads for blocked packages
   - Prevents blocked packages from being installed as dependencies
   - Intercepts requests to `/:package/-/:filename.tgz` routes
@@ -467,6 +474,20 @@ middlewares:
 | `packageAge.minVersionAgeDays` | `number` | `undefined` | Minimum age for versions (days) |
 | `packageAge.warnOnly` | `boolean` | `false` | Only warn, don't block |
 
+### Author Filter Options
+
+| Option | Type | Default | Description |
+|--------|------|---------|-------------|
+| `authorFilter.enabled` | `boolean` | `false` | Enable author filtering |
+| `authorFilter.blockedAuthors` | `string[]` | `[]` | List of author names to block |
+| `authorFilter.blockedAuthorPatterns` | `string[]` | `[]` | Regex patterns for author names |
+| `authorFilter.blockedEmails` | `string[]` | `[]` | List of email addresses to block |
+| `authorFilter.blockedEmailPatterns` | `string[]` | `[]` | Regex patterns for author emails |
+| `authorFilter.blockedEmailDomains` | `string[]` | `[]` | Email domains to block (e.g., `.ru`, `yandex.ru`) |
+| `authorFilter.blockedRegions` | `string[]` | `[]` | Region codes to block (`ru`, `cn`, `by`, `kp`, `ir`, `sy`, `cu`, `sd`) |
+| `authorFilter.requireVerifiedEmail` | `boolean` | `false` | Require author email information |
+| `authorFilter.warnOnly` | `boolean` | `false` | Only warn, don't block |
+
 ### Error Handling Options
 
 | Option | Type | Default | Description |
@@ -533,13 +554,14 @@ npm test:watch
 ```
 
 **Test Results:**
-- ✅ 80 tests passing
+- ✅ 108 tests passing
 - ✅ 60%+ code coverage
 - ✅ SecurityFilterPlugin: 21 tests
 - ✅ PackageAgeChecker: 13 tests
 - ✅ SecurityLogger: 16 tests
 - ✅ LicenseChecker: 15 tests
 - ✅ WhitelistChecker: 15 tests
+- ✅ AuthorChecker: 28 tests
 
 ## 🔧 Development
 
@@ -567,6 +589,7 @@ When metrics are enabled, the plugin tracks:
 - `cve_detected` - CVE vulnerabilities found
 - `license_blocked` - Packages blocked by license rules
 - `package_too_new` - Packages/versions blocked due to age restrictions
+- `author_blocked` - Packages blocked due to author/region filtering
 
 Example metrics output:
 ```json
@@ -656,16 +679,54 @@ packageAge:
   warnOnly: false            # Block, don't just warn
 ```
 
+### 7. Block Packages by Author/Region
+
+```yaml
+# Block packages from specific authors, emails, or regions
+authorFilter:
+  enabled: true
+  # Block specific author names
+  blockedAuthors:
+    - "Suspicious Author"
+    - "Known Bad Actor"
+  # Block author names matching patterns
+  blockedAuthorPatterns:
+    - "^Bot.*"
+    - ".*Spammer$"
+  # Block specific email addresses
+  blockedEmails:
+    - "malicious@example.com"
+  # Block email patterns
+  blockedEmailPatterns:
+    - ".*@temporary-mail\\.com$"
+  # Block entire email domains
+  blockedEmailDomains:
+    - ".ru"           # All .ru domains
+    - "yandex.ru"     # Specific domain
+    - "mail.ru"
+  # Block by region (includes multiple common domains)
+  blockedRegions:
+    - "ru"            # Russia (.ru, yandex.ru, mail.ru, etc.)
+    - "cn"            # China (.cn, qq.com, 163.com, etc.)
+    - "by"            # Belarus
+    - "kp"            # North Korea
+  # Require author information
+  requireVerifiedEmail: true
+  # Warn-only mode (don't block, just log)
+  warnOnly: false
+```
+
 ## 🔐 Security Best Practices
 
 1. **Enable CVE Scanning** - Automatically detect and block vulnerable packages
 2. **Use Whitelist Mode** - For maximum security in sensitive environments
 3. **Enforce License Compliance** - Prevent legal issues with license filtering
 4. **Enable Package Age Filtering** - Block newly published packages to prevent supply chain attacks
-5. **Enable Metrics** - Track security events for audit and compliance
-6. **Regular Updates** - Keep the plugin and CVE database cache updated
-7. **Test Rules** - Use dry run mode (planned) before applying strict rules
-8. **Monitor Logs** - Review security logs regularly for suspicious activity
+5. **Enable Author Filtering** - Block packages from untrusted authors or regions
+6. **Enable Metrics** - Track security events for audit and compliance
+7. **Regular Updates** - Keep the plugin and CVE database cache updated
+8. **Test Rules** - Use dry run mode (planned) before applying strict rules
+9. **Monitor Logs** - Review security logs regularly for suspicious activity
 
 ## 🐛 Troubleshooting
 

package/build/index.d.ts

@@ -20,6 +20,7 @@ export default class SecurityFilterPlugin implements IPluginMiddleware<SecurityC
     private readonly cveChecker;
     private readonly licenseChecker;
     private readonly packageAgeChecker;
+    private readonly authorChecker;
     /**
      * Creates a new SecurityFilterPlugin instance
      * @param {SecurityConfig} config - Plugin configuration
@@ -83,4 +84,5 @@ export { WhitelistChecker } from './lib/whitelist-checker';
 export { CVEChecker } from './lib/cve-checker';
 export { LicenseChecker } from './lib/license-checker';
 export { PackageAgeChecker } from './lib/package-age-checker';
+export { AuthorChecker } from './lib/author-checker';
 export * from './types';

package/build/index.js

@@ -45,7 +45,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PackageAgeChecker = exports.LicenseChecker = exports.CVEChecker = exports.WhitelistChecker = exports.MetricsCollector = exports.SecurityLogger = void 0;
+exports.AuthorChecker = exports.PackageAgeChecker = exports.LicenseChecker = exports.CVEChecker = exports.WhitelistChecker = exports.MetricsCollector = exports.SecurityLogger = void 0;
 const semver = __importStar(require("semver"));
 const logger_1 = require("./lib/logger");
 const metrics_1 = require("./lib/metrics");
@@ -53,6 +53,7 @@ const whitelist_checker_1 = require("./lib/whitelist-checker");
 const cve_checker_1 = require("./lib/cve-checker");
 const license_checker_1 = require("./lib/license-checker");
 const package_age_checker_1 = require("./lib/package-age-checker");
+const author_checker_1 = require("./lib/author-checker");
 /**
  * Security Filter Plugin for Verdaccio
  * Works with both middleware and filter interfaces for complete protection
@@ -88,6 +89,7 @@ class SecurityFilterPlugin {
         this.cveChecker = new cve_checker_1.CVEChecker(this.config.cveCheck);
         this.licenseChecker = new license_checker_1.LicenseChecker(this.config.licenses);
         this.packageAgeChecker = new package_age_checker_1.PackageAgeChecker(this.config.packageAge);
+        this.authorChecker = new author_checker_1.AuthorChecker(this.config.authorFilter);
         // Security rules configuration
         this.securityRules = {
             blockedVersions: this.config.blockedVersions || [],
@@ -135,6 +137,7 @@ class SecurityFilterPlugin {
      * @private
      */
     _logInitialization() {
+        var _a;
         const features = this._getEnabledFeatures();
         this.logger.logInit(features);
         this.logger.debug(`[Init] Config mode: ${this.config.mode || 'not set'}`);
@@ -151,13 +154,17 @@ class SecurityFilterPlugin {
             const summary = this.whitelistChecker.getSummary();
             this.logger.info(`Whitelist mode: ${summary.totalPackages} packages, ${summary.totalPatterns} patterns`);
         }
+        if ((_a = this.config.authorFilter) === null || _a === void 0 ? void 0 : _a.enabled) {
+            const summary = this.authorChecker.getSummary();
+            this.logger.info(`Author filtering enabled: ${summary.blockedAuthors} authors, ${summary.blockedEmails} emails, ${summary.blockedRegions} regions blocked`);
+        }
     }
     /**
      * Get list of enabled features
      * @private
      */
     _getEnabledFeatures() {
-        var _a, _b, _c, _d;
+        var _a, _b, _c, _d, _e;
         const features = [];
         if (this.config.mode === 'whitelist')
             features.push('whitelist-mode');
@@ -169,6 +176,8 @@ class SecurityFilterPlugin {
             features.push('license-filtering');
         if ((_d = this.config.packageAge) === null || _d === void 0 ? void 0 : _d.enabled)
             features.push('package-age-verification');
+        if ((_e = this.config.authorFilter) === null || _e === void 0 ? void 0 : _e.enabled)
+            features.push('author-filtering');
         if (this.securityRules.versionRangeRules.length > 0)
             features.push('version-range-rules');
         if (this.securityRules.blockedPatterns.length > 0)
@@ -375,7 +384,7 @@ class SecurityFilterPlugin {
      */
     filter_metadata(packageInfo) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b, _c, _d, _e;
+            var _a, _b, _c, _d, _e, _f, _g, _h;
             const packageName = packageInfo.name;
             this.logger.info(`[filter_metadata] --> Processing: ${packageName}`);
             try {
@@ -468,12 +477,48 @@ class SecurityFilterPlugin {
                         this.logger.warn(`[filter_metadata] AGE WARNING: ${packageName} - ${ageResult.reason} (warn-only mode)`);
                     }
                 }
+                // 5. Author Filter Check
+                if ((_e = this.config.authorFilter) === null || _e === void 0 ? void 0 : _e.enabled) {
+                    const latestVersion = (_f = packageInfo['dist-tags']) === null || _f === void 0 ? void 0 : _f.latest;
+                    if (latestVersion && ((_g = packageInfo.versions) === null || _g === void 0 ? void 0 : _g[latestVersion])) {
+                        const versionData = packageInfo.versions[latestVersion];
+                        const authorResult = this.authorChecker.checkAuthor(versionData);
+                        if (!authorResult.allowed && !this.config.authorFilter.warnOnly) {
+                            this.logger.warn(`[filter_metadata] AUTHOR BLOCKED: ${packageName} - ${authorResult.reason}`);
+                            this.metrics.record({
+                                timestamp: new Date().toISOString(),
+                                event: 'author_blocked',
+                                packageName,
+                                version: latestVersion,
+                                reason: authorResult.reason || 'Author not allowed',
+                                metadata: {
+                                    blockedBy: authorResult.blockedBy,
+                                    authorInfo: authorResult.authorInfo,
+                                },
+                            });
+                            return Object.assign(Object.assign({}, packageInfo), { versions: {}, 'dist-tags': {}, security: {
+                                    blocked: true,
+                                    reason: authorResult.reason || 'Author not allowed',
+                                    blockedBy: authorResult.blockedBy,
+                                    authorInfo: authorResult.authorInfo,
+                                    plugin: {
+                                        name: 'verdaccio-security-filter',
+                                        version: '2.0.0',
+                                    },
+                                    blockedAt: new Date().toISOString(),
+                                } });
+                        }
+                        else if (!authorResult.allowed && this.config.authorFilter.warnOnly) {
+                            this.logger.warn(`[filter_metadata] AUTHOR WARNING: ${packageName} - ${authorResult.reason} (warn-only mode)`);
+                        }
+                    }
+                }
                 this.logger.info(`[filter_metadata] [OK] ALLOWED: ${packageName}`);
                 return packageInfo;
             }
             catch (error) {
                 this.logger.error(`[filter_metadata] Error processing ${packageName}: ${error.message}`);
-                const errorStrategy = ((_e = this.config.errorHandling) === null || _e === void 0 ? void 0 : _e.onFilterError) || 'fail-open';
+                const errorStrategy = ((_h = this.config.errorHandling) === null || _h === void 0 ? void 0 : _h.onFilterError) || 'fail-open';
                 if (errorStrategy === 'fail-closed') {
                     this.logger.warn(`[filter_metadata] Error handling: fail-closed - BLOCKING ${packageName}`);
                     this.metrics.recordBlock(packageName, '*', `Error during processing: ${error.message}`);
@@ -580,4 +625,6 @@ var license_checker_2 = require("./lib/license-checker");
 Object.defineProperty(exports, "LicenseChecker", { enumerable: true, get: function () { return license_checker_2.LicenseChecker; } });
 var package_age_checker_2 = require("./lib/package-age-checker");
 Object.defineProperty(exports, "PackageAgeChecker", { enumerable: true, get: function () { return package_age_checker_2.PackageAgeChecker; } });
+var author_checker_2 = require("./lib/author-checker");
+Object.defineProperty(exports, "AuthorChecker", { enumerable: true, get: function () { return author_checker_2.AuthorChecker; } });
 __exportStar(require("./types"), exports);

package/build/lib/author-checker.d.ts

@@ -0,0 +1,44 @@
+import { Version } from '@verdaccio/types';
+import { AuthorFilterConfig, AuthorCheckResult } from '../types';
+/**
+ * AuthorChecker validates package authors and maintainers
+ * against configured security policies.
+ */
+export declare class AuthorChecker {
+    private readonly config?;
+    private readonly blockedAuthors;
+    private readonly blockedAuthorPatterns;
+    private readonly blockedEmails;
+    private readonly blockedEmailPatterns;
+    private readonly blockedEmailDomains;
+    private readonly regionDomainMap;
+    constructor(config?: AuthorFilterConfig);
+    /**
+     * Check if package author/maintainer is allowed
+     */
+    checkAuthor(versionData: Version): AuthorCheckResult;
+    /**
+     * Extract author information from package version data
+     */
+    private _extractAuthors;
+    /**
+     * Normalize author data to AuthorInfo format
+     */
+    private _normalizeAuthor;
+    /**
+     * Check a single author against all blocking rules
+     */
+    private _checkSingleAuthor;
+    /**
+     * Get summary of configuration
+     */
+    getSummary(): {
+        enabled: boolean;
+        blockedAuthors: number;
+        blockedAuthorPatterns: number;
+        blockedEmails: number;
+        blockedEmailPatterns: number;
+        blockedEmailDomains: number;
+        blockedRegions: number;
+    };
+}

package/build/lib/author-checker.js

@@ -0,0 +1,194 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorChecker = void 0;
+/**
+ * Region to TLD mapping for email domain filtering
+ */
+const REGION_DOMAINS = {
+    'ru': ['.ru', 'yandex.ru', 'mail.ru', 'rambler.ru', 'ya.ru', 'bk.ru', 'list.ru'],
+    'cn': ['.cn', 'qq.com', '163.com', '126.com', 'sina.com', 'sohu.com'],
+    'by': ['.by', 'tut.by', 'mail.by'],
+    'kp': ['.kp'], // North Korea
+    'ir': ['.ir'], // Iran
+    'sy': ['.sy'], // Syria
+    'cu': ['.cu'], // Cuba
+    'sd': ['.sd'], // Sudan
+};
+/**
+ * AuthorChecker validates package authors and maintainers
+ * against configured security policies.
+ */
+class AuthorChecker {
+    constructor(config) {
+        this.config = config;
+        this.blockedAuthors = new Set(((config === null || config === void 0 ? void 0 : config.blockedAuthors) || []).map(a => a.toLowerCase().trim()));
+        this.blockedAuthorPatterns = ((config === null || config === void 0 ? void 0 : config.blockedAuthorPatterns) || [])
+            .map(pattern => new RegExp(pattern, 'i'));
+        this.blockedEmails = new Set(((config === null || config === void 0 ? void 0 : config.blockedEmails) || []).map(e => e.toLowerCase().trim()));
+        this.blockedEmailPatterns = ((config === null || config === void 0 ? void 0 : config.blockedEmailPatterns) || [])
+            .map(pattern => new RegExp(pattern, 'i'));
+        this.blockedEmailDomains = new Set(((config === null || config === void 0 ? void 0 : config.blockedEmailDomains) || []).map(d => d.toLowerCase().trim()));
+        this.regionDomainMap = new Map();
+        ((config === null || config === void 0 ? void 0 : config.blockedRegions) || []).forEach(region => {
+            const domains = REGION_DOMAINS[region.toLowerCase()] || [];
+            this.regionDomainMap.set(region.toLowerCase(), new Set(domains));
+        });
+    }
+    /**
+     * Check if package author/maintainer is allowed
+     */
+    checkAuthor(versionData) {
+        var _a;
+        if (!((_a = this.config) === null || _a === void 0 ? void 0 : _a.enabled)) {
+            return { allowed: true };
+        }
+        const authors = this._extractAuthors(versionData);
+        if (authors.length === 0) {
+            if (this.config.requireVerifiedEmail) {
+                return {
+                    allowed: false,
+                    reason: 'No author information available',
+                    blockedBy: 'email',
+                };
+            }
+            return { allowed: true };
+        }
+        for (const author of authors) {
+            const result = this._checkSingleAuthor(author);
+            if (!result.allowed) {
+                return result;
+            }
+        }
+        return { allowed: true };
+    }
+    /**
+     * Extract author information from package version data
+     */
+    _extractAuthors(versionData) {
+        const authors = [];
+        if (versionData.author) {
+            authors.push(this._normalizeAuthor(versionData.author));
+        }
+        if (Array.isArray(versionData.maintainers)) {
+            versionData.maintainers.forEach(maintainer => {
+                authors.push(this._normalizeAuthor(maintainer));
+            });
+        }
+        if (Array.isArray(versionData.contributors)) {
+            versionData.contributors.forEach(contributor => {
+                authors.push(this._normalizeAuthor(contributor));
+            });
+        }
+        return authors;
+    }
+    /**
+     * Normalize author data to AuthorInfo format
+     */
+    _normalizeAuthor(author) {
+        if (typeof author === 'string') {
+            const emailMatch = author.match(/<([^>]+)>/);
+            const nameMatch = author.match(/^([^<]+)/);
+            return {
+                name: nameMatch ? nameMatch[1].trim() : undefined,
+                email: emailMatch ? emailMatch[1].trim() : undefined,
+            };
+        }
+        return {
+            name: author.name,
+            email: author.email,
+            url: author.url,
+        };
+    }
+    /**
+     * Check a single author against all blocking rules
+     */
+    _checkSingleAuthor(author) {
+        // Check blocked author names
+        if (author.name) {
+            const normalizedName = author.name.toLowerCase().trim();
+            if (this.blockedAuthors.has(normalizedName)) {
+                return {
+                    allowed: false,
+                    reason: `Author name "${author.name}" is blocked`,
+                    blockedBy: 'name',
+                    authorInfo: author,
+                };
+            }
+            for (const pattern of this.blockedAuthorPatterns) {
+                if (pattern.test(author.name)) {
+                    return {
+                        allowed: false,
+                        reason: `Author name "${author.name}" matches blocked pattern`,
+                        blockedBy: 'name',
+                        authorInfo: author,
+                    };
+                }
+            }
+        }
+        // Check blocked emails
+        if (author.email) {
+            const normalizedEmail = author.email.toLowerCase().trim();
+            if (this.blockedEmails.has(normalizedEmail)) {
+                return {
+                    allowed: false,
+                    reason: `Author email "${author.email}" is blocked`,
+                    blockedBy: 'email',
+                    authorInfo: author,
+                };
+            }
+            for (const pattern of this.blockedEmailPatterns) {
+                if (pattern.test(author.email)) {
+                    return {
+                        allowed: false,
+                        reason: `Author email "${author.email}" matches blocked pattern`,
+                        blockedBy: 'email',
+                        authorInfo: author,
+                    };
+                }
+            }
+            // Check blocked email domains
+            for (const domain of this.blockedEmailDomains) {
+                if (normalizedEmail.endsWith(domain) || normalizedEmail.includes(`@${domain}`)) {
+                    return {
+                        allowed: false,
+                        reason: `Author email domain "${domain}" is blocked`,
+                        blockedBy: 'domain',
+                        authorInfo: author,
+                    };
+                }
+            }
+            // Check blocked regions
+            for (const [region, domains] of this.regionDomainMap.entries()) {
+                for (const domain of domains) {
+                    if (normalizedEmail.endsWith(domain) ||
+                        normalizedEmail.endsWith(`@${domain}`) ||
+                        normalizedEmail.includes(`@${domain}`)) {
+                        return {
+                            allowed: false,
+                            reason: `Author email from blocked region "${region.toUpperCase()}"`,
+                            blockedBy: 'region',
+                            authorInfo: author,
+                        };
+                    }
+                }
+            }
+        }
+        return { allowed: true };
+    }
+    /**
+     * Get summary of configuration
+     */
+    getSummary() {
+        var _a;
+        return {
+            enabled: ((_a = this.config) === null || _a === void 0 ? void 0 : _a.enabled) || false,
+            blockedAuthors: this.blockedAuthors.size,
+            blockedAuthorPatterns: this.blockedAuthorPatterns.length,
+            blockedEmails: this.blockedEmails.size,
+            blockedEmailPatterns: this.blockedEmailPatterns.length,
+            blockedEmailDomains: this.blockedEmailDomains.size,
+            blockedRegions: this.regionDomainMap.size,
+        };
+    }
+}
+exports.AuthorChecker = AuthorChecker;

package/build/lib/metrics.js

@@ -186,6 +186,7 @@ class MetricsCollector {
             cve_detected: 0,
             license_blocked: 0,
             package_too_new: 0,
+            author_blocked: 0,
         };
         this.metricsBuffer.forEach(metric => {
             summary[metric.event] = (summary[metric.event] || 0) + 1;

package/build/types.d.ts

@@ -45,6 +45,17 @@ export interface PackageAgeConfig {
     minVersionAgeDays?: number;
     warnOnly?: boolean;
 }
+export interface AuthorFilterConfig {
+    enabled: boolean;
+    blockedAuthors?: string[];
+    blockedAuthorPatterns?: string[];
+    blockedEmails?: string[];
+    blockedEmailPatterns?: string[];
+    blockedEmailDomains?: string[];
+    blockedRegions?: string[];
+    requireVerifiedEmail?: boolean;
+    warnOnly?: boolean;
+}
 export interface SecurityConfig extends Config {
     blockedVersions?: string[];
     blockedPatterns?: string[];
@@ -61,6 +72,7 @@ export interface SecurityConfig extends Config {
     logger?: LoggerConfig;
     metrics?: MetricsConfig;
     packageAge?: PackageAgeConfig;
+    authorFilter?: AuthorFilterConfig;
     errorHandling?: {
         onFilterError?: 'fail-open' | 'fail-closed';
         onCveCheckError?: 'fail-open' | 'fail-closed';
@@ -111,9 +123,20 @@ export interface CVECheckResult {
 }
 export interface MetricsData {
     timestamp: string;
-    event: 'block' | 'fallback' | 'publish_rejected' | 'cve_detected' | 'license_blocked' | 'package_too_new';
+    event: 'block' | 'fallback' | 'publish_rejected' | 'cve_detected' | 'license_blocked' | 'package_too_new' | 'author_blocked';
     packageName: string;
     version?: string;
     reason: string;
     metadata?: Record<string, any>;
 }
+export interface AuthorInfo {
+    name?: string;
+    email?: string;
+    url?: string;
+}
+export interface AuthorCheckResult {
+    allowed: boolean;
+    reason?: string;
+    blockedBy?: 'name' | 'email' | 'domain' | 'region';
+    authorInfo?: AuthorInfo;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "verdaccio-security-filter",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Advanced security filter plugin for Verdaccio with version range blocking and fallback strategies",
   "main": "build/index.js",
   "types": "build/index.d.ts",