verdaccio-security-filter 1.3.0 → 1.3.2

package/build/lib/cve-checker.d.ts

@@ -1,47 +1,21 @@
 import { CVECheckConfig, CVECheckResult } from '../types';
-/**
- * CVE Checker that integrates with vulnerability databases
- */
 export declare class CVEChecker {
     private config;
     private cache;
     private lastUpdate;
+    private readonly MAX_CACHE_SIZE;
+    private saveTimer;
+    private readonly SAVE_DEBOUNCE_MS;
     constructor(config?: CVECheckConfig);
-    /**
-     * Check if a package version has known vulnerabilities
-     */
     checkPackage(packageName: string, version: string): Promise<CVECheckResult>;
-    /**
-     * Fetch vulnerabilities from configured databases
-     */
     private fetchVulnerabilities;
-    /**
-     * Fetch vulnerabilities from OSV (Open Source Vulnerabilities) database
-     * https://osv.dev/
-     */
     private fetchFromOSV;
-    /**
-     * Sleep utility for retry delays
-     */
     private sleep;
-    /**
-     * Map OSV severity to our severity levels
-     */
     private mapOSVSeverity;
-    /**
-     * Check if cache is stale
-     */
     private isCacheStale;
-    /**
-     * Load cache from disk
-     */
     private loadCache;
-    /**
-     * Save cache to disk
-     */
+    private debouncedSaveCache;
     private saveCache;
-    /**
-     * Clear cache
-     */
     clearCache(): void;
+    destroy(): void;
 }

package/build/lib/cve-checker.js

@@ -45,13 +45,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CVEChecker = void 0;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
-/**
- * CVE Checker that integrates with vulnerability databases
- */
+const lru_cache_1 = require("./lru-cache");
 class CVEChecker {
     constructor(config) {
-        this.cache = new Map();
         this.lastUpdate = 0;
+        this.MAX_CACHE_SIZE = 1000;
+        this.saveTimer = null;
+        this.SAVE_DEBOUNCE_MS = 5000;
         this.config = {
             enabled: (config === null || config === void 0 ? void 0 : config.enabled) || false,
             databases: (config === null || config === void 0 ? void 0 : config.databases) || ['osv'],
@@ -60,13 +60,11 @@ class CVEChecker {
             updateInterval: (config === null || config === void 0 ? void 0 : config.updateInterval) || 24,
             cacheDir: (config === null || config === void 0 ? void 0 : config.cacheDir) || './.security-cache',
         };
+        this.cache = new lru_cache_1.LRUCache(this.MAX_CACHE_SIZE);
         if (this.config.enabled) {
             this.loadCache();
         }
     }
-    /**
-     * Check if a package version has known vulnerabilities
-     */
     checkPackage(packageName, version) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!this.config.enabled) {
@@ -79,13 +77,10 @@ class CVEChecker {
                 };
             }
             const cacheKey = `${packageName}@${version}`;
-            // Check cache first
             if (this.cache.has(cacheKey) && !this.isCacheStale()) {
                 return this.cache.get(cacheKey);
             }
-            // Fetch from databases
             const vulnerabilities = yield this.fetchVulnerabilities(packageName, version);
-            // Filter by configured severity
             const filteredVulnerabilities = vulnerabilities.filter(vuln => this.config.severity.includes(vuln.severity));
             const result = {
                 package: packageName,
@@ -94,15 +89,11 @@ class CVEChecker {
                 isVulnerable: filteredVulnerabilities.length > 0,
                 checkedAt: new Date().toISOString(),
             };
-            // Cache result
             this.cache.set(cacheKey, result);
-            this.saveCache();
+            this.debouncedSaveCache();
             return result;
         });
     }
-    /**
-     * Fetch vulnerabilities from configured databases
-     */
     fetchVulnerabilities(packageName, version) {
         return __awaiter(this, void 0, void 0, function* () {
             const vulnerabilities = [];
@@ -113,10 +104,8 @@ class CVEChecker {
                             vulnerabilities.push(...yield this.fetchFromOSV(packageName, version));
                             break;
                         case 'snyk':
-                            // Snyk integration would go here (requires API key)
                             break;
                         case 'github':
-                            // GitHub Advisory Database integration would go here
                             break;
                     }
                 }
@@ -128,10 +117,6 @@ class CVEChecker {
             return vulnerabilities;
         });
     }
-    /**
-     * Fetch vulnerabilities from OSV (Open Source Vulnerabilities) database
-     * https://osv.dev/
-     */
     fetchFromOSV(packageName, version) {
         return __awaiter(this, void 0, void 0, function* () {
             const maxRetries = 3;
@@ -199,20 +184,13 @@ class CVEChecker {
             return [];
         });
     }
-    /**
-     * Sleep utility for retry delays
-     */
     sleep(ms) {
         return new Promise(resolve => setTimeout(resolve, ms));
     }
-    /**
-     * Map OSV severity to our severity levels
-     */
     mapOSVSeverity(osvSeverity) {
         if (!osvSeverity || osvSeverity.length === 0) {
             return 'medium';
         }
-        // OSV uses CVSS scores
         const severity = osvSeverity[0];
         if (severity.type === 'CVSS_V3') {
             const score = parseFloat(severity.score);
@@ -226,24 +204,22 @@ class CVEChecker {
         }
         return 'medium';
     }
-    /**
-     * Check if cache is stale
-     */
     isCacheStale() {
         const now = Date.now();
         const updateIntervalMs = this.config.updateInterval * 60 * 60 * 1000;
         return now - this.lastUpdate > updateIntervalMs;
     }
-    /**
-     * Load cache from disk
-     */
     loadCache() {
         try {
             const cacheFile = path.join(this.config.cacheDir, 'cve-cache.json');
             if (fs.existsSync(cacheFile)) {
                 const data = fs.readFileSync(cacheFile, 'utf8');
                 const parsed = JSON.parse(data);
-                this.cache = new Map(Object.entries(parsed.cache));
+                const entries = Object.entries(parsed.cache);
+                const sortedEntries = entries.slice(-this.MAX_CACHE_SIZE);
+                sortedEntries.forEach(([key, value]) => {
+                    this.cache.set(key, value);
+                });
                 this.lastUpdate = parsed.lastUpdate || 0;
             }
         }
@@ -252,9 +228,15 @@ class CVEChecker {
             console.error('[CVE Checker] Failed to load cache:', message);
         }
     }
-    /**
-     * Save cache to disk
-     */
+    debouncedSaveCache() {
+        if (this.saveTimer) {
+            clearTimeout(this.saveTimer);
+        }
+        this.saveTimer = setTimeout(() => {
+            this.saveCache();
+            this.saveTimer = null;
+        }, this.SAVE_DEBOUNCE_MS);
+    }
     saveCache() {
         try {
             const cacheFile = path.join(this.config.cacheDir, 'cve-cache.json');
@@ -263,7 +245,7 @@ class CVEChecker {
                 fs.mkdirSync(dir, { recursive: true });
             }
             const data = {
-                cache: Object.fromEntries(this.cache),
+                cache: Object.fromEntries(this.cache.entries()),
                 lastUpdate: Date.now(),
             };
             fs.writeFileSync(cacheFile, JSON.stringify(data, null, 2), 'utf8');
@@ -274,13 +256,18 @@ class CVEChecker {
             console.error('[CVE Checker] Failed to save cache:', message);
         }
     }
-    /**
-     * Clear cache
-     */
     clearCache() {
         this.cache.clear();
         this.lastUpdate = 0;
         this.saveCache();
     }
+    destroy() {
+        if (this.saveTimer) {
+            clearTimeout(this.saveTimer);
+            this.saveTimer = null;
+        }
+        this.saveCache();
+        this.cache.clear();
+    }
 }
 exports.CVEChecker = CVEChecker;

package/build/lib/license-checker.d.ts

@@ -1,37 +1,16 @@
 import { LicenseConfig } from '../types';
 import { Version } from '@verdaccio/types';
-/**
- * License checker for validating package licenses
- */
 export declare class LicenseChecker {
     private config;
     constructor(config?: LicenseConfig);
-    /**
-     * Check if a package version's license is allowed
-     */
     checkLicense(versionData: Version): {
         allowed: boolean;
         reason?: string;
         license?: string;
     };
-    /**
-     * Extract license from version data
-     */
     private extractLicense;
-    /**
-     * Check if license is blocked
-     */
     private isLicenseBlocked;
-    /**
-     * Check if license is allowed
-     */
     private isLicenseAllowed;
-    /**
-     * Get common open source licenses
-     */
     static getCommonOpenSourceLicenses(): string[];
-    /**
-     * Get common copyleft licenses
-     */
     static getCopyleftLicenses(): string[];
 }

package/build/lib/license-checker.js

@@ -1,9 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LicenseChecker = void 0;
-/**
- * License checker for validating package licenses
- */
 class LicenseChecker {
     constructor(config) {
         this.config = {
@@ -12,12 +9,8 @@ class LicenseChecker {
             requireLicense: (config === null || config === void 0 ? void 0 : config.requireLicense) !== false,
         };
     }
-    /**
-     * Check if a package version's license is allowed
-     */
     checkLicense(versionData) {
         const license = this.extractLicense(versionData);
-        // Check if license is missing
         if (!license || license === 'UNLICENSED' || license === '') {
             if (this.config.requireLicense) {
                 return {
@@ -28,7 +21,6 @@ class LicenseChecker {
             }
             return { allowed: true };
         }
-        // Check blocked list
         if (this.isLicenseBlocked(license)) {
             return {
                 allowed: false,
@@ -36,7 +28,6 @@ class LicenseChecker {
                 license,
             };
         }
-        // Check allowed list (if specified)
         if (this.config.allowed.length > 0 && !this.isLicenseAllowed(license)) {
             return {
                 allowed: false,
@@ -46,54 +37,36 @@ class LicenseChecker {
         }
         return { allowed: true, license };
     }
-    /**
-     * Extract license from version data
-     */
     extractLicense(versionData) {
         if (!versionData.license) {
             return null;
         }
-        // Handle string license
         if (typeof versionData.license === 'string') {
             return versionData.license;
         }
-        // Handle SPDX license object
         if (typeof versionData.license === 'object' && 'type' in versionData.license) {
             return versionData.license.type;
         }
         return null;
     }
-    /**
-     * Check if license is blocked
-     */
     isLicenseBlocked(license) {
         return this.config.blocked.some(blocked => {
-            // Exact match
             if (blocked === license) {
                 return true;
             }
-            // Handle SPDX expressions (e.g., "MIT OR Apache-2.0")
             const licenseTokens = license.split(/\s+(?:OR|AND)\s+/i);
             return licenseTokens.some(token => token.trim() === blocked);
         });
     }
-    /**
-     * Check if license is allowed
-     */
     isLicenseAllowed(license) {
         return this.config.allowed.some(allowed => {
-            // Exact match
             if (allowed === license) {
                 return true;
             }
-            // Handle SPDX expressions (e.g., "MIT OR Apache-2.0")
             const licenseTokens = license.split(/\s+(?:OR|AND)\s+/i);
             return licenseTokens.some(token => token.trim() === allowed);
         });
     }
-    /**
-     * Get common open source licenses
-     */
     static getCommonOpenSourceLicenses() {
         return [
             'MIT',
@@ -106,9 +79,6 @@ class LicenseChecker {
             'Unlicense',
         ];
     }
-    /**
-     * Get common copyleft licenses
-     */
     static getCopyleftLicenses() {
         return [
             'GPL-2.0',

package/build/lib/logger.d.ts

@@ -1,8 +1,5 @@
 import { Logger } from '@verdaccio/types';
 import { LoggerConfig } from '../types';
-/**
- * Enhanced logger wrapper with configurable log levels and formatting
- */
 export declare class SecurityLogger {
     private verdaccioLogger;
     private config;
@@ -15,28 +12,10 @@ export declare class SecurityLogger {
     info(message: string, ...args: any[]): void;
     warn(message: string, ...args: any[]): void;
     error(message: string, ...args: any[]): void;
-    /**
-     * Log package blocking event
-     */
     logBlock(packageName: string, version: string, reason: string): void;
-    /**
-     * Log fallback event
-     */
     logFallback(packageName: string, fromVersion: string, toVersion: string, reason?: string): void;
-    /**
-     * Log CVE detection
-     */
     logCVE(packageName: string, version: string, cveId: string, severity: string): void;
-    /**
-     * Log license violation
-     */
     logLicense(packageName: string, version: string, license: string, reason: string): void;
-    /**
-     * Log publish rejection
-     */
     logPublishRejected(packageName: string, version: string, reason: string): void;
-    /**
-     * Log initialization
-     */
     logInit(features: string[]): void;
 }

package/build/lib/logger.js

@@ -1,9 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SecurityLogger = void 0;
-/**
- * Enhanced logger wrapper with configurable log levels and formatting
- */
 class SecurityLogger {
     constructor(verdaccioLogger, config) {
         this.prefix = '[Security Filter]';
@@ -54,40 +51,22 @@ class SecurityLogger {
             this.verdaccioLogger.error(this.formatMessage(message), ...args);
         }
     }
-    /**
-     * Log package blocking event
-     */
     logBlock(packageName, version, reason) {
         this.warn(`Blocked ${packageName}@${version} - ${reason}`);
     }
-    /**
-     * Log fallback event
-     */
     logFallback(packageName, fromVersion, toVersion, reason) {
         const reasonText = reason ? ` (${reason})` : '';
         this.info(`Fallback applied: ${packageName}@${fromVersion} -> ${toVersion}${reasonText}`);
     }
-    /**
-     * Log CVE detection
-     */
     logCVE(packageName, version, cveId, severity) {
         this.warn(`CVE detected: ${cveId} [${severity}] in ${packageName}@${version}`);
     }
-    /**
-     * Log license violation
-     */
     logLicense(packageName, version, license, reason) {
         this.warn(`License violation: ${packageName}@${version} has ${license} - ${reason}`);
     }
-    /**
-     * Log publish rejection
-     */
     logPublishRejected(packageName, version, reason) {
         this.warn(`Publish rejected: ${packageName}@${version} - ${reason}`);
     }
-    /**
-     * Log initialization
-     */
     logInit(features) {
         this.info(`Plugin initialized with features: ${features.join(', ')}`);
     }

package/build/lib/lru-cache.d.ts

@@ -0,0 +1,12 @@
+export declare class LRUCache<K, V> {
+    private cache;
+    private readonly maxSize;
+    constructor(maxSize?: number);
+    get(key: K): V | undefined;
+    set(key: K, value: V): void;
+    has(key: K): boolean;
+    delete(key: K): boolean;
+    clear(): void;
+    get size(): number;
+    entries(): IterableIterator<[K, V]>;
+}

package/build/lib/lru-cache.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LRUCache = void 0;
+class LRUCache {
+    constructor(maxSize = 1000) {
+        this.cache = new Map();
+        this.maxSize = maxSize;
+    }
+    get(key) {
+        if (!this.cache.has(key)) {
+            return undefined;
+        }
+        const value = this.cache.get(key);
+        this.cache.delete(key);
+        this.cache.set(key, value);
+        return value;
+    }
+    set(key, value) {
+        if (this.cache.has(key)) {
+            this.cache.delete(key);
+        }
+        else if (this.cache.size >= this.maxSize) {
+            const firstKey = this.cache.keys().next().value;
+            if (firstKey !== undefined) {
+                this.cache.delete(firstKey);
+            }
+        }
+        this.cache.set(key, value);
+    }
+    has(key) {
+        return this.cache.has(key);
+    }
+    delete(key) {
+        return this.cache.delete(key);
+    }
+    clear() {
+        this.cache.clear();
+    }
+    get size() {
+        return this.cache.size;
+    }
+    entries() {
+        return this.cache.entries();
+    }
+}
+exports.LRUCache = LRUCache;

package/build/lib/metrics.d.ts

@@ -1,54 +1,19 @@
 import { MetricsConfig, MetricsData } from '../types';
-/**
- * Metrics collector for tracking security events
- */
 export declare class MetricsCollector {
     private config;
     private metricsBuffer;
     private readonly bufferSize;
+    private readonly maxBufferSize;
     constructor(config?: MetricsConfig);
-    /**
-     * Record a security event
-     */
     record(event: MetricsData): void;
-    /**
-     * Record a block event
-     */
     recordBlock(packageName: string, version: string, reason: string, metadata?: Record<string, any>): void;
-    /**
-     * Record a fallback event
-     */
     recordFallback(packageName: string, fromVersion: string, toVersion: string, reason: string): void;
-    /**
-     * Record a publish rejection
-     */
     recordPublishRejected(packageName: string, version: string, reason: string): void;
-    /**
-     * Record a CVE detection
-     */
     recordCVE(packageName: string, version: string, cveId: string, severity: string): void;
-    /**
-     * Record a license block
-     */
     recordLicenseBlock(packageName: string, version: string, license: string, reason: string): void;
-    /**
-     * Record a package-too-new event
-     */
     recordPackageTooNew(packageName: string, version: string, reason: string, metadata?: Record<string, any>): void;
-    /**
-     * Flush metrics buffer to output
-     */
     flush(): void;
-    /**
-     * Write metrics to file
-     */
     private writeToFile;
-    /**
-     * Get metrics summary
-     */
     getSummary(): Record<string, number>;
-    /**
-     * Cleanup - flush remaining metrics
-     */
     cleanup(): void;
 }