verdaccio-security-filter 1.2.0 → 1.3.1

package/README.md

@@ -2,6 +2,7 @@
 
 Advanced security filter plugin for Verdaccio with **dual-layer protection architecture** combining middleware interception and metadata filtering for comprehensive package security.
 
+[![Stand With Ukraine](https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/badges/StandWithUkraine.svg)](https://stand-with-ukraine.pp.ua)
 [![npm version](https://img.shields.io/npm/v/verdaccio-security-filter.svg)](https://www.npmjs.com/package/verdaccio-security-filter)
 [![npm downloads](https://img.shields.io/npm/dm/verdaccio-security-filter.svg)](https://www.npmjs.com/package/verdaccio-security-filter)
 [![CI](https://github.com/ponomarenko/verdaccio-security-filter/actions/workflows/ci.yml/badge.svg)](https://github.com/ponomarenko/verdaccio-security-filter/actions/workflows/ci.yml)
@@ -71,6 +72,13 @@ This plugin implements **two independent security layers** for complete protecti
   - **Minimum Package Age** - Require packages to exist for a minimum number of days
   - **Minimum Version Age** - Require specific versions to exist for a minimum number of days
   - **Warn-Only Mode** - Log warnings without blocking
+- **Author Filtering** - Block packages based on author information
+  - **Block by Author Name** - Block specific author names or patterns
+  - **Block by Email** - Block specific email addresses or patterns
+  - **Block by Email Domain** - Block entire email domains (e.g., `.ru`, `yandex.ru`)
+  - **Block by Region** - Block authors from specific regions based on email domains
+  - **Maintainer & Contributor Checking** - Validates all package maintainers and contributors
+  - **Warn-Only Mode** - Log warnings without blocking
 - **Middleware Interception** - HTTP middleware that blocks tarball downloads for blocked packages
   - Prevents blocked packages from being installed as dependencies
   - Intercepts requests to `/:package/-/:filename.tgz` routes
@@ -467,6 +475,20 @@ middlewares:
 | `packageAge.minVersionAgeDays` | `number` | `undefined` | Minimum age for versions (days) |
 | `packageAge.warnOnly` | `boolean` | `false` | Only warn, don't block |
 
+### Author Filter Options
+
+| Option | Type | Default | Description |
+|--------|------|---------|-------------|
+| `authorFilter.enabled` | `boolean` | `false` | Enable author filtering |
+| `authorFilter.blockedAuthors` | `string[]` | `[]` | List of author names to block |
+| `authorFilter.blockedAuthorPatterns` | `string[]` | `[]` | Regex patterns for author names |
+| `authorFilter.blockedEmails` | `string[]` | `[]` | List of email addresses to block |
+| `authorFilter.blockedEmailPatterns` | `string[]` | `[]` | Regex patterns for author emails |
+| `authorFilter.blockedEmailDomains` | `string[]` | `[]` | Email domains to block (e.g., `.ru`, `yandex.ru`) |
+| `authorFilter.blockedRegions` | `string[]` | `[]` | Region codes to block (`ru`, `cn`, `by`, `kp`, `ir`, `sy`, `cu`, `sd`) |
+| `authorFilter.requireVerifiedEmail` | `boolean` | `false` | Require author email information |
+| `authorFilter.warnOnly` | `boolean` | `false` | Only warn, don't block |
+
 ### Error Handling Options
 
 | Option | Type | Default | Description |
@@ -533,13 +555,14 @@ npm test:watch
 ```
 
 **Test Results:**
-- ✅ 80 tests passing
+- ✅ 108 tests passing
 - ✅ 60%+ code coverage
 - ✅ SecurityFilterPlugin: 21 tests
 - ✅ PackageAgeChecker: 13 tests
 - ✅ SecurityLogger: 16 tests
 - ✅ LicenseChecker: 15 tests
 - ✅ WhitelistChecker: 15 tests
+- ✅ AuthorChecker: 28 tests
 
 ## 🔧 Development
 
@@ -567,6 +590,7 @@ When metrics are enabled, the plugin tracks:
 - `cve_detected` - CVE vulnerabilities found
 - `license_blocked` - Packages blocked by license rules
 - `package_too_new` - Packages/versions blocked due to age restrictions
+- `author_blocked` - Packages blocked due to author/region filtering
 
 Example metrics output:
 ```json
@@ -656,16 +680,54 @@ packageAge:
   warnOnly: false            # Block, don't just warn
 ```
 
+### 7. Block Packages by Author/Region
+
+```yaml
+# Block packages from specific authors, emails, or regions
+authorFilter:
+  enabled: true
+  # Block specific author names
+  blockedAuthors:
+    - "Suspicious Author"
+    - "Known Bad Actor"
+  # Block author names matching patterns
+  blockedAuthorPatterns:
+    - "^Bot.*"
+    - ".*Spammer$"
+  # Block specific email addresses
+  blockedEmails:
+    - "malicious@example.com"
+  # Block email patterns
+  blockedEmailPatterns:
+    - ".*@temporary-mail\\.com$"
+  # Block entire email domains
+  blockedEmailDomains:
+    - ".ru"           # All .ru domains
+    - "yandex.ru"     # Specific domain
+    - "mail.ru"
+  # Block by region (includes multiple common domains)
+  blockedRegions:
+    - "ru"            # Russia (.ru, yandex.ru, mail.ru, etc.)
+    - "cn"            # China (.cn, qq.com, 163.com, etc.)
+    - "by"            # Belarus
+    - "kp"            # North Korea
+  # Require author information
+  requireVerifiedEmail: true
+  # Warn-only mode (don't block, just log)
+  warnOnly: false
+```
+
 ## 🔐 Security Best Practices
 
 1. **Enable CVE Scanning** - Automatically detect and block vulnerable packages
 2. **Use Whitelist Mode** - For maximum security in sensitive environments
 3. **Enforce License Compliance** - Prevent legal issues with license filtering
 4. **Enable Package Age Filtering** - Block newly published packages to prevent supply chain attacks
-5. **Enable Metrics** - Track security events for audit and compliance
-6. **Regular Updates** - Keep the plugin and CVE database cache updated
-7. **Test Rules** - Use dry run mode (planned) before applying strict rules
-8. **Monitor Logs** - Review security logs regularly for suspicious activity
+5. **Enable Author Filtering** - Block packages from untrusted authors or regions
+6. **Enable Metrics** - Track security events for audit and compliance
+7. **Regular Updates** - Keep the plugin and CVE database cache updated
+8. **Test Rules** - Use dry run mode (planned) before applying strict rules
+9. **Monitor Logs** - Review security logs regularly for suspicious activity
 
 ## 🐛 Troubleshooting
 

package/build/index.d.ts

@@ -20,6 +20,7 @@ export default class SecurityFilterPlugin implements IPluginMiddleware<SecurityC
     private readonly cveChecker;
     private readonly licenseChecker;
     private readonly packageAgeChecker;
+    private readonly authorChecker;
     /**
      * Creates a new SecurityFilterPlugin instance
      * @param {SecurityConfig} config - Plugin configuration
@@ -76,6 +77,11 @@ export default class SecurityFilterPlugin implements IPluginMiddleware<SecurityC
      * @private
      */
     private _getAppliedRules;
+    /**
+     * Cleanup plugin resources
+     * Should be called when Verdaccio shuts down
+     */
+    destroy(): void;
 }
 export { SecurityLogger } from './lib/logger';
 export { MetricsCollector } from './lib/metrics';
@@ -83,4 +89,5 @@ export { WhitelistChecker } from './lib/whitelist-checker';
 export { CVEChecker } from './lib/cve-checker';
 export { LicenseChecker } from './lib/license-checker';
 export { PackageAgeChecker } from './lib/package-age-checker';
+export { AuthorChecker } from './lib/author-checker';
 export * from './types';

package/build/index.js

@@ -45,7 +45,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PackageAgeChecker = exports.LicenseChecker = exports.CVEChecker = exports.WhitelistChecker = exports.MetricsCollector = exports.SecurityLogger = void 0;
+exports.AuthorChecker = exports.PackageAgeChecker = exports.LicenseChecker = exports.CVEChecker = exports.WhitelistChecker = exports.MetricsCollector = exports.SecurityLogger = void 0;
 const semver = __importStar(require("semver"));
 const logger_1 = require("./lib/logger");
 const metrics_1 = require("./lib/metrics");
@@ -53,6 +53,7 @@ const whitelist_checker_1 = require("./lib/whitelist-checker");
 const cve_checker_1 = require("./lib/cve-checker");
 const license_checker_1 = require("./lib/license-checker");
 const package_age_checker_1 = require("./lib/package-age-checker");
+const author_checker_1 = require("./lib/author-checker");
 /**
  * Security Filter Plugin for Verdaccio
  * Works with both middleware and filter interfaces for complete protection
@@ -88,6 +89,7 @@ class SecurityFilterPlugin {
         this.cveChecker = new cve_checker_1.CVEChecker(this.config.cveCheck);
         this.licenseChecker = new license_checker_1.LicenseChecker(this.config.licenses);
         this.packageAgeChecker = new package_age_checker_1.PackageAgeChecker(this.config.packageAge);
+        this.authorChecker = new author_checker_1.AuthorChecker(this.config.authorFilter);
         // Security rules configuration
         this.securityRules = {
             blockedVersions: this.config.blockedVersions || [],
@@ -135,6 +137,7 @@ class SecurityFilterPlugin {
      * @private
      */
     _logInitialization() {
+        var _a;
         const features = this._getEnabledFeatures();
         this.logger.logInit(features);
         this.logger.debug(`[Init] Config mode: ${this.config.mode || 'not set'}`);
@@ -151,13 +154,17 @@ class SecurityFilterPlugin {
             const summary = this.whitelistChecker.getSummary();
             this.logger.info(`Whitelist mode: ${summary.totalPackages} packages, ${summary.totalPatterns} patterns`);
         }
+        if ((_a = this.config.authorFilter) === null || _a === void 0 ? void 0 : _a.enabled) {
+            const summary = this.authorChecker.getSummary();
+            this.logger.info(`Author filtering enabled: ${summary.blockedAuthors} authors, ${summary.blockedEmails} emails, ${summary.blockedRegions} regions blocked`);
+        }
     }
     /**
      * Get list of enabled features
      * @private
      */
     _getEnabledFeatures() {
-        var _a, _b, _c, _d;
+        var _a, _b, _c, _d, _e;
         const features = [];
         if (this.config.mode === 'whitelist')
             features.push('whitelist-mode');
@@ -169,6 +176,8 @@ class SecurityFilterPlugin {
             features.push('license-filtering');
         if ((_d = this.config.packageAge) === null || _d === void 0 ? void 0 : _d.enabled)
             features.push('package-age-verification');
+        if ((_e = this.config.authorFilter) === null || _e === void 0 ? void 0 : _e.enabled)
+            features.push('author-filtering');
         if (this.securityRules.versionRangeRules.length > 0)
             features.push('version-range-rules');
         if (this.securityRules.blockedPatterns.length > 0)
@@ -281,79 +290,33 @@ class SecurityFilterPlugin {
                     // Check if package should be blocked
                     const blockResult = yield this._checkPackageBlock(packageName);
                     if (blockResult.blocked) {
-                        // Intercept the response
-                        const originalSend = res.send;
-                        const originalJson = res.json;
-                        // eslint-disable-next-line @typescript-eslint/no-this-alias
-                        const self = this;
-                        // Override res.json to intercept JSON responses
-                        res.json = function (body) {
-                            if (body && typeof body === 'object' && body.name === packageName) {
-                                // This is package metadata - modify it to show blocked info
-                                self.logger.warn(`[Middleware] [X] BLOCKED METADATA: ${packageName} - ${blockResult.reason}`);
-                                self.logger.info(`[Middleware] Modifying response to show blocking info`);
-                                const blockedResponse = {
-                                    name: packageName,
-                                    versions: {},
-                                    'dist-tags': {},
-                                    security: {
-                                        blocked: true,
-                                        reason: blockResult.reason,
-                                        plugin: {
-                                            name: 'verdaccio-security-filter',
-                                            version: '1.0.0',
-                                            mode: self.config.mode || 'blacklist',
-                                        },
-                                        blockedAt: new Date().toISOString(),
-                                        rules: self._getAppliedRules(packageName),
-                                        message: `This package has been blocked by security filter: ${blockResult.reason}`,
-                                        contact: 'Please contact your registry administrator for more information',
-                                    },
-                                    _security: {
-                                        blocked: true,
-                                        reason: blockResult.reason,
-                                        blockedBy: 'verdaccio-security-filter',
-                                        blockedAt: new Date().toISOString(),
-                                    }
-                                };
-                                return originalJson.call(this, blockedResponse);
-                            }
-                            return originalJson.call(this, body);
-                        };
-                        // Override res.send for non-JSON responses
-                        res.send = function (body) {
-                            if (typeof body === 'string') {
-                                try {
-                                    const parsed = JSON.parse(body);
-                                    if (parsed && parsed.name === packageName) {
-                                        self.logger.warn(`[Middleware] [X] BLOCKED METADATA: ${packageName} - ${blockResult.reason}`);
-                                        const blockedResponse = {
-                                            name: packageName,
-                                            versions: {},
-                                            'dist-tags': {},
-                                            security: {
-                                                blocked: true,
-                                                reason: blockResult.reason,
-                                                plugin: {
-                                                    name: 'verdaccio-security-filter',
-                                                    version: '1.0.0',
-                                                    mode: self.config.mode || 'blacklist',
-                                                },
-                                                blockedAt: new Date().toISOString(),
-                                                rules: self._getAppliedRules(packageName),
-                                                message: `This package has been blocked by security filter: ${blockResult.reason}`,
-                                                contact: 'Please contact your registry administrator for more information',
-                                            }
-                                        };
-                                        return originalSend.call(this, JSON.stringify(blockedResponse));
-                                    }
-                                }
-                                catch (_a) {
-                                    // Not JSON, pass through
-                                }
+                        this.logger.warn(`[Middleware] [X] BLOCKED METADATA: ${packageName} - ${blockResult.reason}`);
+                        const blockedResponse = {
+                            name: packageName,
+                            versions: {},
+                            'dist-tags': {},
+                            security: {
+                                blocked: true,
+                                reason: blockResult.reason,
+                                plugin: {
+                                    name: 'verdaccio-security-filter',
+                                    version: '1.0.0',
+                                    mode: this.config.mode || 'blacklist',
+                                },
+                                blockedAt: new Date().toISOString(),
+                                rules: this._getAppliedRules(packageName),
+                                message: `This package has been blocked by security filter: ${blockResult.reason}`,
+                                contact: 'Please contact your registry administrator for more information',
+                            },
+                            _security: {
+                                blocked: true,
+                                reason: blockResult.reason,
+                                blockedBy: 'verdaccio-security-filter',
+                                blockedAt: new Date().toISOString(),
                             }
-                            return originalSend.call(this, body);
                         };
+                        res.status(200).json(blockedResponse);
+                        return;
                     }
                     else {
                         this.logger.info(`[Middleware] [OK] ALLOWED METADATA: ${packageName}`);
@@ -375,7 +338,7 @@ class SecurityFilterPlugin {
      */
     filter_metadata(packageInfo) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b, _c, _d, _e;
+            var _a, _b, _c, _d, _e, _f, _g, _h;
             const packageName = packageInfo.name;
             this.logger.info(`[filter_metadata] --> Processing: ${packageName}`);
             try {
@@ -397,16 +360,24 @@ class SecurityFilterPlugin {
                             rules: this._getAppliedRules(packageName),
                         } });
                 }
-                // 2. CVE Check - check all versions
+                // 2. CVE Check - check versions in controlled batches
                 if ((_a = this.config.cveCheck) === null || _a === void 0 ? void 0 : _a.enabled) {
                     const versions = Object.keys(packageInfo.versions || {});
                     const vulnerableVersions = [];
-                    for (const version of versions) {
-                        const cveResult = yield this.cveChecker.checkPackage(packageName, version);
-                        if (cveResult.isVulnerable) {
-                            vulnerableVersions.push(version);
-                            this.logger.warn(`[filter_metadata] CVE found in ${packageName}@${version}: ${cveResult.vulnerabilities.length} vulnerabilities`);
-                        }
+                    const BATCH_SIZE = 10;
+                    for (let i = 0; i < versions.length; i += BATCH_SIZE) {
+                        const batch = versions.slice(i, i + BATCH_SIZE);
+                        const results = yield Promise.allSettled(batch.map(version => this.cveChecker.checkPackage(packageName, version)));
+                        results.forEach((result, index) => {
+                            if (result.status === 'fulfilled' && result.value.isVulnerable) {
+                                const version = batch[index];
+                                vulnerableVersions.push(version);
+                                this.logger.warn(`[filter_metadata] CVE found in ${packageName}@${version}: ${result.value.vulnerabilities.length} vulnerabilities`);
+                            }
+                            else if (result.status === 'rejected') {
+                                this.logger.error(`[filter_metadata] CVE check failed for ${packageName}@${batch[index]}: ${result.reason}`);
+                            }
+                        });
                     }
                     // If configured to auto-block and vulnerabilities found
                     if (this.config.cveCheck.autoBlock && vulnerableVersions.length > 0) {
@@ -468,12 +439,48 @@ class SecurityFilterPlugin {
                         this.logger.warn(`[filter_metadata] AGE WARNING: ${packageName} - ${ageResult.reason} (warn-only mode)`);
                     }
                 }
+                // 5. Author Filter Check
+                if ((_e = this.config.authorFilter) === null || _e === void 0 ? void 0 : _e.enabled) {
+                    const latestVersion = (_f = packageInfo['dist-tags']) === null || _f === void 0 ? void 0 : _f.latest;
+                    if (latestVersion && ((_g = packageInfo.versions) === null || _g === void 0 ? void 0 : _g[latestVersion])) {
+                        const versionData = packageInfo.versions[latestVersion];
+                        const authorResult = this.authorChecker.checkAuthor(versionData);
+                        if (!authorResult.allowed && !this.config.authorFilter.warnOnly) {
+                            this.logger.warn(`[filter_metadata] AUTHOR BLOCKED: ${packageName} - ${authorResult.reason}`);
+                            this.metrics.record({
+                                timestamp: new Date().toISOString(),
+                                event: 'author_blocked',
+                                packageName,
+                                version: latestVersion,
+                                reason: authorResult.reason || 'Author not allowed',
+                                metadata: {
+                                    blockedBy: authorResult.blockedBy,
+                                    authorInfo: authorResult.authorInfo,
+                                },
+                            });
+                            return Object.assign(Object.assign({}, packageInfo), { versions: {}, 'dist-tags': {}, security: {
+                                    blocked: true,
+                                    reason: authorResult.reason || 'Author not allowed',
+                                    blockedBy: authorResult.blockedBy,
+                                    authorInfo: authorResult.authorInfo,
+                                    plugin: {
+                                        name: 'verdaccio-security-filter',
+                                        version: '2.0.0',
+                                    },
+                                    blockedAt: new Date().toISOString(),
+                                } });
+                        }
+                        else if (!authorResult.allowed && this.config.authorFilter.warnOnly) {
+                            this.logger.warn(`[filter_metadata] AUTHOR WARNING: ${packageName} - ${authorResult.reason} (warn-only mode)`);
+                        }
+                    }
+                }
                 this.logger.info(`[filter_metadata] [OK] ALLOWED: ${packageName}`);
                 return packageInfo;
             }
             catch (error) {
                 this.logger.error(`[filter_metadata] Error processing ${packageName}: ${error.message}`);
-                const errorStrategy = ((_e = this.config.errorHandling) === null || _e === void 0 ? void 0 : _e.onFilterError) || 'fail-open';
+                const errorStrategy = ((_h = this.config.errorHandling) === null || _h === void 0 ? void 0 : _h.onFilterError) || 'fail-open';
                 if (errorStrategy === 'fail-closed') {
                     this.logger.warn(`[filter_metadata] Error handling: fail-closed - BLOCKING ${packageName}`);
                     this.metrics.recordBlock(packageName, '*', `Error during processing: ${error.message}`);
@@ -565,6 +572,21 @@ class SecurityFilterPlugin {
         }
         return rules;
     }
+    /**
+     * Cleanup plugin resources
+     * Should be called when Verdaccio shuts down
+     */
+    destroy() {
+        this.logger.info('[Cleanup] Shutting down security filter plugin');
+        try {
+            this.cveChecker.destroy();
+            this.metrics.cleanup();
+            this.logger.info('[Cleanup] Plugin resources cleaned up successfully');
+        }
+        catch (error) {
+            this.logger.error(`[Cleanup] Error during cleanup: ${error.message}`);
+        }
+    }
 }
 exports.default = SecurityFilterPlugin;
 // Export utility classes for testing
@@ -580,4 +602,6 @@ var license_checker_2 = require("./lib/license-checker");
 Object.defineProperty(exports, "LicenseChecker", { enumerable: true, get: function () { return license_checker_2.LicenseChecker; } });
 var package_age_checker_2 = require("./lib/package-age-checker");
 Object.defineProperty(exports, "PackageAgeChecker", { enumerable: true, get: function () { return package_age_checker_2.PackageAgeChecker; } });
+var author_checker_2 = require("./lib/author-checker");
+Object.defineProperty(exports, "AuthorChecker", { enumerable: true, get: function () { return author_checker_2.AuthorChecker; } });
 __exportStar(require("./types"), exports);

package/build/lib/author-checker.d.ts

@@ -0,0 +1,44 @@
+import { Version } from '@verdaccio/types';
+import { AuthorFilterConfig, AuthorCheckResult } from '../types';
+/**
+ * AuthorChecker validates package authors and maintainers
+ * against configured security policies.
+ */
+export declare class AuthorChecker {
+    private readonly config?;
+    private readonly blockedAuthors;
+    private readonly blockedAuthorPatterns;
+    private readonly blockedEmails;
+    private readonly blockedEmailPatterns;
+    private readonly blockedEmailDomains;
+    private readonly regionDomainMap;
+    constructor(config?: AuthorFilterConfig);
+    /**
+     * Check if package author/maintainer is allowed
+     */
+    checkAuthor(versionData: Version): AuthorCheckResult;
+    /**
+     * Extract author information from package version data
+     */
+    private _extractAuthors;
+    /**
+     * Normalize author data to AuthorInfo format
+     */
+    private _normalizeAuthor;
+    /**
+     * Check a single author against all blocking rules
+     */
+    private _checkSingleAuthor;
+    /**
+     * Get summary of configuration
+     */
+    getSummary(): {
+        enabled: boolean;
+        blockedAuthors: number;
+        blockedAuthorPatterns: number;
+        blockedEmails: number;
+        blockedEmailPatterns: number;
+        blockedEmailDomains: number;
+        blockedRegions: number;
+    };
+}

package/build/lib/author-checker.js

@@ -0,0 +1,194 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorChecker = void 0;
+/**
+ * Region to TLD mapping for email domain filtering
+ */
+const REGION_DOMAINS = {
+    'ru': ['.ru', 'yandex.ru', 'mail.ru', 'rambler.ru', 'ya.ru', 'bk.ru', 'list.ru'],
+    'cn': ['.cn', 'qq.com', '163.com', '126.com', 'sina.com', 'sohu.com'],
+    'by': ['.by', 'tut.by', 'mail.by'],
+    'kp': ['.kp'], // North Korea
+    'ir': ['.ir'], // Iran
+    'sy': ['.sy'], // Syria
+    'cu': ['.cu'], // Cuba
+    'sd': ['.sd'], // Sudan
+};
+/**
+ * AuthorChecker validates package authors and maintainers
+ * against configured security policies.
+ */
+class AuthorChecker {
+    constructor(config) {
+        this.config = config;
+        this.blockedAuthors = new Set(((config === null || config === void 0 ? void 0 : config.blockedAuthors) || []).map(a => a.toLowerCase().trim()));
+        this.blockedAuthorPatterns = ((config === null || config === void 0 ? void 0 : config.blockedAuthorPatterns) || [])
+            .map(pattern => new RegExp(pattern, 'i'));
+        this.blockedEmails = new Set(((config === null || config === void 0 ? void 0 : config.blockedEmails) || []).map(e => e.toLowerCase().trim()));
+        this.blockedEmailPatterns = ((config === null || config === void 0 ? void 0 : config.blockedEmailPatterns) || [])
+            .map(pattern => new RegExp(pattern, 'i'));
+        this.blockedEmailDomains = new Set(((config === null || config === void 0 ? void 0 : config.blockedEmailDomains) || []).map(d => d.toLowerCase().trim()));
+        this.regionDomainMap = new Map();
+        ((config === null || config === void 0 ? void 0 : config.blockedRegions) || []).forEach(region => {
+            const domains = REGION_DOMAINS[region.toLowerCase()] || [];
+            this.regionDomainMap.set(region.toLowerCase(), new Set(domains));
+        });
+    }
+    /**
+     * Check if package author/maintainer is allowed
+     */
+    checkAuthor(versionData) {
+        var _a;
+        if (!((_a = this.config) === null || _a === void 0 ? void 0 : _a.enabled)) {
+            return { allowed: true };
+        }
+        const authors = this._extractAuthors(versionData);
+        if (authors.length === 0) {
+            if (this.config.requireVerifiedEmail) {
+                return {
+                    allowed: false,
+                    reason: 'No author information available',
+                    blockedBy: 'email',
+                };
+            }
+            return { allowed: true };
+        }
+        for (const author of authors) {
+            const result = this._checkSingleAuthor(author);
+            if (!result.allowed) {
+                return result;
+            }
+        }
+        return { allowed: true };
+    }
+    /**
+     * Extract author information from package version data
+     */
+    _extractAuthors(versionData) {
+        const authors = [];
+        if (versionData.author) {
+            authors.push(this._normalizeAuthor(versionData.author));
+        }
+        if (Array.isArray(versionData.maintainers)) {
+            versionData.maintainers.forEach(maintainer => {
+                authors.push(this._normalizeAuthor(maintainer));
+            });
+        }
+        if (Array.isArray(versionData.contributors)) {
+            versionData.contributors.forEach(contributor => {
+                authors.push(this._normalizeAuthor(contributor));
+            });
+        }
+        return authors;
+    }
+    /**
+     * Normalize author data to AuthorInfo format
+     */
+    _normalizeAuthor(author) {
+        if (typeof author === 'string') {
+            const emailMatch = author.match(/<([^>]+)>/);
+            const nameMatch = author.match(/^([^<]+)/);
+            return {
+                name: nameMatch ? nameMatch[1].trim() : undefined,
+                email: emailMatch ? emailMatch[1].trim() : undefined,
+            };
+        }
+        return {
+            name: author.name,
+            email: author.email,
+            url: author.url,
+        };
+    }
+    /**
+     * Check a single author against all blocking rules
+     */
+    _checkSingleAuthor(author) {
+        // Check blocked author names
+        if (author.name) {
+            const normalizedName = author.name.toLowerCase().trim();
+            if (this.blockedAuthors.has(normalizedName)) {
+                return {
+                    allowed: false,
+                    reason: `Author name "${author.name}" is blocked`,
+                    blockedBy: 'name',
+                    authorInfo: author,
+                };
+            }
+            for (const pattern of this.blockedAuthorPatterns) {
+                if (pattern.test(author.name)) {
+                    return {
+                        allowed: false,
+                        reason: `Author name "${author.name}" matches blocked pattern`,
+                        blockedBy: 'name',
+                        authorInfo: author,
+                    };
+                }
+            }
+        }
+        // Check blocked emails
+        if (author.email) {
+            const normalizedEmail = author.email.toLowerCase().trim();
+            if (this.blockedEmails.has(normalizedEmail)) {
+                return {
+                    allowed: false,
+                    reason: `Author email "${author.email}" is blocked`,
+                    blockedBy: 'email',
+                    authorInfo: author,
+                };
+            }
+            for (const pattern of this.blockedEmailPatterns) {
+                if (pattern.test(author.email)) {
+                    return {
+                        allowed: false,
+                        reason: `Author email "${author.email}" matches blocked pattern`,
+                        blockedBy: 'email',
+                        authorInfo: author,
+                    };
+                }
+            }
+            // Check blocked email domains
+            for (const domain of this.blockedEmailDomains) {
+                if (normalizedEmail.endsWith(domain) || normalizedEmail.includes(`@${domain}`)) {
+                    return {
+                        allowed: false,
+                        reason: `Author email domain "${domain}" is blocked`,
+                        blockedBy: 'domain',
+                        authorInfo: author,
+                    };
+                }
+            }
+            // Check blocked regions
+            for (const [region, domains] of this.regionDomainMap.entries()) {
+                for (const domain of domains) {
+                    if (normalizedEmail.endsWith(domain) ||
+                        normalizedEmail.endsWith(`@${domain}`) ||
+                        normalizedEmail.includes(`@${domain}`)) {
+                        return {
+                            allowed: false,
+                            reason: `Author email from blocked region "${region.toUpperCase()}"`,
+                            blockedBy: 'region',
+                            authorInfo: author,
+                        };
+                    }
+                }
+            }
+        }
+        return { allowed: true };
+    }
+    /**
+     * Get summary of configuration
+     */
+    getSummary() {
+        var _a;
+        return {
+            enabled: ((_a = this.config) === null || _a === void 0 ? void 0 : _a.enabled) || false,
+            blockedAuthors: this.blockedAuthors.size,
+            blockedAuthorPatterns: this.blockedAuthorPatterns.length,
+            blockedEmails: this.blockedEmails.size,
+            blockedEmailPatterns: this.blockedEmailPatterns.length,
+            blockedEmailDomains: this.blockedEmailDomains.size,
+            blockedRegions: this.regionDomainMap.size,
+        };
+    }
+}
+exports.AuthorChecker = AuthorChecker;

package/build/lib/cve-checker.d.ts

@@ -6,6 +6,9 @@ export declare class CVEChecker {
     private config;
     private cache;
     private lastUpdate;
+    private readonly MAX_CACHE_SIZE;
+    private saveTimer;
+    private readonly SAVE_DEBOUNCE_MS;
     constructor(config?: CVECheckConfig);
     /**
      * Check if a package version has known vulnerabilities
@@ -37,11 +40,19 @@ export declare class CVEChecker {
      */
     private loadCache;
     /**
-     * Save cache to disk
+     * Debounced save cache to reduce I/O operations
+     */
+    private debouncedSaveCache;
+    /**
+     * Save cache to disk immediately
      */
     private saveCache;
     /**
      * Clear cache
      */
     clearCache(): void;
+    /**
+     * Cleanup resources
+     */
+    destroy(): void;
 }

package/build/lib/cve-checker.js

@@ -45,13 +45,16 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CVEChecker = void 0;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
+const lru_cache_1 = require("./lru-cache");
 /**
  * CVE Checker that integrates with vulnerability databases
  */
 class CVEChecker {
     constructor(config) {
-        this.cache = new Map();
         this.lastUpdate = 0;
+        this.MAX_CACHE_SIZE = 1000;
+        this.saveTimer = null;
+        this.SAVE_DEBOUNCE_MS = 5000;
         this.config = {
             enabled: (config === null || config === void 0 ? void 0 : config.enabled) || false,
             databases: (config === null || config === void 0 ? void 0 : config.databases) || ['osv'],
@@ -60,6 +63,7 @@ class CVEChecker {
             updateInterval: (config === null || config === void 0 ? void 0 : config.updateInterval) || 24,
             cacheDir: (config === null || config === void 0 ? void 0 : config.cacheDir) || './.security-cache',
         };
+        this.cache = new lru_cache_1.LRUCache(this.MAX_CACHE_SIZE);
         if (this.config.enabled) {
             this.loadCache();
         }
@@ -96,7 +100,7 @@ class CVEChecker {
             };
             // Cache result
             this.cache.set(cacheKey, result);
-            this.saveCache();
+            this.debouncedSaveCache();
             return result;
         });
     }
@@ -243,7 +247,11 @@ class CVEChecker {
             if (fs.existsSync(cacheFile)) {
                 const data = fs.readFileSync(cacheFile, 'utf8');
                 const parsed = JSON.parse(data);
-                this.cache = new Map(Object.entries(parsed.cache));
+                const entries = Object.entries(parsed.cache);
+                const sortedEntries = entries.slice(-this.MAX_CACHE_SIZE);
+                sortedEntries.forEach(([key, value]) => {
+                    this.cache.set(key, value);
+                });
                 this.lastUpdate = parsed.lastUpdate || 0;
             }
         }
@@ -253,7 +261,19 @@ class CVEChecker {
         }
     }
     /**
-     * Save cache to disk
+     * Debounced save cache to reduce I/O operations
+     */
+    debouncedSaveCache() {
+        if (this.saveTimer) {
+            clearTimeout(this.saveTimer);
+        }
+        this.saveTimer = setTimeout(() => {
+            this.saveCache();
+            this.saveTimer = null;
+        }, this.SAVE_DEBOUNCE_MS);
+    }
+    /**
+     * Save cache to disk immediately
      */
     saveCache() {
         try {
@@ -263,7 +283,7 @@ class CVEChecker {
                 fs.mkdirSync(dir, { recursive: true });
             }
             const data = {
-                cache: Object.fromEntries(this.cache),
+                cache: Object.fromEntries(this.cache.entries()),
                 lastUpdate: Date.now(),
             };
             fs.writeFileSync(cacheFile, JSON.stringify(data, null, 2), 'utf8');
@@ -282,5 +302,16 @@ class CVEChecker {
         this.lastUpdate = 0;
         this.saveCache();
     }
+    /**
+     * Cleanup resources
+     */
+    destroy() {
+        if (this.saveTimer) {
+            clearTimeout(this.saveTimer);
+            this.saveTimer = null;
+        }
+        this.saveCache();
+        this.cache.clear();
+    }
 }
 exports.CVEChecker = CVEChecker;

package/build/lib/lru-cache.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Simple LRU (Least Recently Used) Cache implementation with size limits
+ */
+export declare class LRUCache<K, V> {
+    private cache;
+    private readonly maxSize;
+    constructor(maxSize?: number);
+    get(key: K): V | undefined;
+    set(key: K, value: V): void;
+    has(key: K): boolean;
+    delete(key: K): boolean;
+    clear(): void;
+    get size(): number;
+    entries(): IterableIterator<[K, V]>;
+}

package/build/lib/lru-cache.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LRUCache = void 0;
+/**
+ * Simple LRU (Least Recently Used) Cache implementation with size limits
+ */
+class LRUCache {
+    constructor(maxSize = 1000) {
+        this.cache = new Map();
+        this.maxSize = maxSize;
+    }
+    get(key) {
+        if (!this.cache.has(key)) {
+            return undefined;
+        }
+        const value = this.cache.get(key);
+        this.cache.delete(key);
+        this.cache.set(key, value);
+        return value;
+    }
+    set(key, value) {
+        if (this.cache.has(key)) {
+            this.cache.delete(key);
+        }
+        else if (this.cache.size >= this.maxSize) {
+            const firstKey = this.cache.keys().next().value;
+            if (firstKey !== undefined) {
+                this.cache.delete(firstKey);
+            }
+        }
+        this.cache.set(key, value);
+    }
+    has(key) {
+        return this.cache.has(key);
+    }
+    delete(key) {
+        return this.cache.delete(key);
+    }
+    clear() {
+        this.cache.clear();
+    }
+    get size() {
+        return this.cache.size;
+    }
+    entries() {
+        return this.cache.entries();
+    }
+}
+exports.LRUCache = LRUCache;

package/build/lib/metrics.d.ts

@@ -6,6 +6,7 @@ export declare class MetricsCollector {
     private config;
     private metricsBuffer;
     private readonly bufferSize;
+    private readonly maxBufferSize;
     constructor(config?: MetricsConfig);
     /**
      * Record a security event

package/build/lib/metrics.js

@@ -43,6 +43,7 @@ class MetricsCollector {
     constructor(config) {
         this.metricsBuffer = [];
         this.bufferSize = 100;
+        this.maxBufferSize = 500;
         this.config = {
             enabled: (config === null || config === void 0 ? void 0 : config.enabled) || false,
             output: (config === null || config === void 0 ? void 0 : config.output) || 'stdout',
@@ -56,6 +57,9 @@ class MetricsCollector {
         if (!this.config.enabled) {
             return;
         }
+        if (this.metricsBuffer.length >= this.maxBufferSize) {
+            this.flush();
+        }
         this.metricsBuffer.push(event);
         if (this.metricsBuffer.length >= this.bufferSize) {
             this.flush();
@@ -186,6 +190,7 @@ class MetricsCollector {
             cve_detected: 0,
             license_blocked: 0,
             package_too_new: 0,
+            author_blocked: 0,
         };
         this.metricsBuffer.forEach(metric => {
             summary[metric.event] = (summary[metric.event] || 0) + 1;

package/build/types.d.ts

@@ -45,6 +45,17 @@ export interface PackageAgeConfig {
     minVersionAgeDays?: number;
     warnOnly?: boolean;
 }
+export interface AuthorFilterConfig {
+    enabled: boolean;
+    blockedAuthors?: string[];
+    blockedAuthorPatterns?: string[];
+    blockedEmails?: string[];
+    blockedEmailPatterns?: string[];
+    blockedEmailDomains?: string[];
+    blockedRegions?: string[];
+    requireVerifiedEmail?: boolean;
+    warnOnly?: boolean;
+}
 export interface SecurityConfig extends Config {
     blockedVersions?: string[];
     blockedPatterns?: string[];
@@ -61,6 +72,7 @@ export interface SecurityConfig extends Config {
     logger?: LoggerConfig;
     metrics?: MetricsConfig;
     packageAge?: PackageAgeConfig;
+    authorFilter?: AuthorFilterConfig;
     errorHandling?: {
         onFilterError?: 'fail-open' | 'fail-closed';
         onCveCheckError?: 'fail-open' | 'fail-closed';
@@ -111,9 +123,20 @@ export interface CVECheckResult {
 }
 export interface MetricsData {
     timestamp: string;
-    event: 'block' | 'fallback' | 'publish_rejected' | 'cve_detected' | 'license_blocked' | 'package_too_new';
+    event: 'block' | 'fallback' | 'publish_rejected' | 'cve_detected' | 'license_blocked' | 'package_too_new' | 'author_blocked';
     packageName: string;
     version?: string;
     reason: string;
     metadata?: Record<string, any>;
 }
+export interface AuthorInfo {
+    name?: string;
+    email?: string;
+    url?: string;
+}
+export interface AuthorCheckResult {
+    allowed: boolean;
+    reason?: string;
+    blockedBy?: 'name' | 'email' | 'domain' | 'region';
+    authorInfo?: AuthorInfo;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "verdaccio-security-filter",
-  "version": "1.2.0",
+  "version": "1.3.1",
   "description": "Advanced security filter plugin for Verdaccio with version range blocking and fallback strategies",
   "main": "build/index.js",
   "types": "build/index.d.ts",