verdaccio-security-filter 1.3.7 → 1.3.8

package/README.md

@@ -430,10 +430,12 @@ middlewares:
 | `cveCheck.enabled` | `boolean` | `false` | Enable CVE scanning |
 | `cveCheck.databases` | `string[]` | `['osv']` | Databases: `osv`, `snyk`, `github` |
 | `cveCheck.severity` | `string[]` | `['high', 'critical']` | Severity levels to check |
-| `cveCheck.autoBlock` | `boolean` | `false` | Auto-block vulnerable packages |
+| `cveCheck.autoBlock` | `boolean` | `false` | Remove vulnerable versions from metadata (whole package blocked if every version is vulnerable) |
 | `cveCheck.updateInterval` | `number` | `24` | Cache update interval (hours) |
 | `cveCheck.cacheDir` | `string` | `./.security-cache` | Cache directory path |
 
+> **Note on `autoBlock` and dist-tags:** only the vulnerable versions are removed; unaffected versions stay installable. Any dist-tag (including `latest`) that points to a removed version is dropped and **not** re-pointed to another version. If `latest` is vulnerable, `npm install <pkg>` without a version or range will fail - install an explicit safe version or range instead (e.g. `npm install <pkg>@^1.2.0`).
+
 ### License Options
 
 | Option | Type | Default | Description |

package/build/index.js

@@ -318,18 +318,34 @@ class SecurityFilterPlugin {
                     }
                     if (this.config.cveCheck.autoBlock && vulnerableVersions.length > 0) {
                         const reason = `Package has ${vulnerableVersions.length} vulnerable version(s)`;
-                        this.logger.warn(`[filter_metadata] CVE BLOCKED: ${packageName} - ${reason}`);
-                        this.metrics.recordBlock(packageName, '*', reason);
-                        return Object.assign(Object.assign({}, pkg), { versions: {}, 'dist-tags': {}, security: {
-                                blocked: true,
-                                reason,
-                                vulnerableVersions,
-                                plugin: {
-                                    name: 'verdaccio-security-filter',
-                                    version: '2.0.0',
-                                },
-                                blockedAt: new Date().toISOString(),
-                            } });
+                        if (vulnerableVersions.length === versions.length) {
+                            this.logger.warn(`[filter_metadata] CVE BLOCKED: ${packageName} - ${reason}`);
+                            this.metrics.recordBlock(packageName, '*', reason);
+                            return Object.assign(Object.assign({}, pkg), { versions: {}, 'dist-tags': {}, security: {
+                                    blocked: true,
+                                    reason,
+                                    vulnerableVersions,
+                                    plugin: {
+                                        name: 'verdaccio-security-filter',
+                                        version: '2.0.0',
+                                    },
+                                    blockedAt: new Date().toISOString(),
+                                } });
+                        }
+                        this.logger.warn(`[filter_metadata] CVE FILTERED: ${packageName} - ${reason}: ${vulnerableVersions.join(', ')}`);
+                        const filteredVersions = Object.assign({}, pkg.versions);
+                        for (const version of vulnerableVersions) {
+                            delete filteredVersions[version];
+                            this.metrics.recordBlock(packageName, version, reason);
+                        }
+                        const filteredDistTags = Object.assign({}, pkg['dist-tags']);
+                        for (const [tag, tagVersion] of Object.entries(filteredDistTags)) {
+                            if (vulnerableVersions.includes(tagVersion)) {
+                                delete filteredDistTags[tag];
+                                this.logger.debug(`[filter_metadata] Removed dist-tag "${tag}" pointing to vulnerable version ${tagVersion}`);
+                            }
+                        }
+                        pkg = Object.assign(Object.assign({}, pkg), { versions: filteredVersions, 'dist-tags': filteredDistTags });
                     }
                 }
                 if (this.config.licenses && this.config.licenses.allowed && this.config.licenses.allowed.length > 0) {

package/build/lib/cve-checker.d.ts

@@ -12,6 +12,9 @@ export declare class CVEChecker {
     private fetchFromOSV;
     private sleep;
     private mapOSVSeverity;
+    private mapDatabaseSpecificSeverity;
+    private scoreToSeverity;
+    private computeCVSSv3BaseScore;
     private isCacheStale;
     private loadCache;
     private debouncedSaveCache;

package/build/lib/cve-checker.js

@@ -46,6 +46,21 @@ exports.CVEChecker = void 0;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const lru_cache_1 = require("./lru-cache");
+const CVSS_V3_WEIGHTS = {
+    AV: { N: 0.85, A: 0.62, L: 0.55, P: 0.2 },
+    AC: { L: 0.77, H: 0.44 },
+    UI: { N: 0.85, R: 0.62 },
+    PR_UNCHANGED: { N: 0.85, L: 0.62, H: 0.27 },
+    PR_CHANGED: { N: 0.85, L: 0.68, H: 0.5 },
+    CIA: { H: 0.56, L: 0.22, N: 0 },
+};
+function roundUpCvssScore(value) {
+    const intValue = Math.round(value * 100000);
+    if (intValue % 10000 === 0) {
+        return intValue / 100000;
+    }
+    return (Math.floor(intValue / 10000) + 1) / 10;
+}
 class CVEChecker {
     constructor(config) {
         this.lastUpdate = 0;
@@ -157,7 +172,7 @@ class CVEChecker {
                         var _a, _b, _c, _d, _e, _f, _g;
                         return ({
                             id: vuln.id,
-                            severity: this.mapOSVSeverity(vuln.severity),
+                            severity: this.mapOSVSeverity(vuln),
                             summary: vuln.summary || vuln.details || 'No description available',
                             affectedVersions: ((_a = vuln.affected) === null || _a === void 0 ? void 0 : _a.map((a) => { var _a; return (_a = a.ranges) === null || _a === void 0 ? void 0 : _a.map((r) => { var _a; return (_a = r.events) === null || _a === void 0 ? void 0 : _a.map((e) => e.introduced || e.fixed).filter(Boolean); }).flat(); }).flat()) || [],
                             fixedVersion: (_g = (_f = (_e = (_d = (_c = (_b = vuln.affected) === null || _b === void 0 ? void 0 : _b[0]) === null || _c === void 0 ? void 0 : _c.ranges) === null || _d === void 0 ? void 0 : _d[0]) === null || _e === void 0 ? void 0 : _e.events) === null || _f === void 0 ? void 0 : _f.find((e) => e.fixed)) === null || _g === void 0 ? void 0 : _g.fixed,
@@ -187,23 +202,83 @@ class CVEChecker {
     sleep(ms) {
         return new Promise(resolve => setTimeout(resolve, ms));
     }
-    mapOSVSeverity(osvSeverity) {
-        if (!osvSeverity || osvSeverity.length === 0) {
-            return 'medium';
+    mapOSVSeverity(vuln) {
+        var _a, _b, _c, _d;
+        const databaseSeverity = this.mapDatabaseSpecificSeverity((_a = vuln === null || vuln === void 0 ? void 0 : vuln.database_specific) === null || _a === void 0 ? void 0 : _a.severity);
+        if (databaseSeverity) {
+            return databaseSeverity;
         }
-        const severity = osvSeverity[0];
-        if (severity.type === 'CVSS_V3') {
-            const score = parseFloat(severity.score);
-            if (score >= 9.0)
-                return 'critical';
-            if (score >= 7.0)
-                return 'high';
-            if (score >= 4.0)
-                return 'medium';
-            return 'low';
+        const cvssV3 = (_b = vuln === null || vuln === void 0 ? void 0 : vuln.severity) === null || _b === void 0 ? void 0 : _b.find(entry => entry.type === 'CVSS_V3');
+        const score = cvssV3 ? this.computeCVSSv3BaseScore(cvssV3.score) : null;
+        if (score !== null) {
+            return this.scoreToSeverity(score);
+        }
+        if ((_c = vuln === null || vuln === void 0 ? void 0 : vuln.severity) === null || _c === void 0 ? void 0 : _c.some(entry => entry.type === 'CVSS_V4')) {
+            console.debug(`[CVE Checker] ${(_d = vuln.id) !== null && _d !== void 0 ? _d : 'unknown vulnerability'} only has a CVSS_V4 vector, which is not scored yet - defaulting severity to medium`);
         }
         return 'medium';
     }
+    mapDatabaseSpecificSeverity(severity) {
+        if (typeof severity !== 'string') {
+            return null;
+        }
+        switch (severity.toUpperCase()) {
+            case 'LOW': return 'low';
+            case 'MODERATE': return 'medium';
+            case 'HIGH': return 'high';
+            case 'CRITICAL': return 'critical';
+            default: return null;
+        }
+    }
+    scoreToSeverity(score) {
+        if (score >= 9.0)
+            return 'critical';
+        if (score >= 7.0)
+            return 'high';
+        if (score >= 4.0)
+            return 'medium';
+        return 'low';
+    }
+    computeCVSSv3BaseScore(vector) {
+        if (typeof vector !== 'string') {
+            return null;
+        }
+        const metrics = {};
+        for (const part of vector.split('/')) {
+            const [key, value] = part.split(':');
+            if (key && value) {
+                metrics[key] = value;
+            }
+        }
+        const scope = metrics.S;
+        const av = CVSS_V3_WEIGHTS.AV[metrics.AV];
+        const ac = CVSS_V3_WEIGHTS.AC[metrics.AC];
+        const ui = CVSS_V3_WEIGHTS.UI[metrics.UI];
+        const pr = scope === 'C'
+            ? CVSS_V3_WEIGHTS.PR_CHANGED[metrics.PR]
+            : CVSS_V3_WEIGHTS.PR_UNCHANGED[metrics.PR];
+        const c = CVSS_V3_WEIGHTS.CIA[metrics.C];
+        const i = CVSS_V3_WEIGHTS.CIA[metrics.I];
+        const a = CVSS_V3_WEIGHTS.CIA[metrics.A];
+        if ((scope !== 'U' && scope !== 'C') || [av, ac, ui, pr, c, i, a].some(value => value === undefined)) {
+            return null;
+        }
+        const impactSubScoreBase = 1 - (1 - c) * (1 - i) * (1 - a);
+        const impactSubScore = scope === 'U'
+            ? 6.42 * impactSubScoreBase
+            : 7.52 * (impactSubScoreBase - 0.029) - 3.25 * Math.pow(impactSubScoreBase - 0.02, 15);
+        if (impactSubScore <= 0) {
+            return 0;
+        }
+        const exploitability = 8.22 * av * ac * pr * ui;
+        const rawScore = scope === 'U'
+            ? impactSubScore + exploitability
+            : 1.08 * (impactSubScore + exploitability);
+        const cappedScore = Math.min(rawScore, 10);
+        return metrics.CVSS === '3.0'
+            ? Math.ceil(cappedScore * 10) / 10
+            : roundUpCvssScore(cappedScore);
+    }
     isCacheStale() {
         const now = Date.now();
         const updateIntervalMs = this.config.updateInterval * 60 * 60 * 1000;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "verdaccio-security-filter",
-  "version": "1.3.7",
+  "version": "1.3.8",
   "description": "Advanced security filter plugin for Verdaccio with version range blocking and fallback strategies",
   "main": "build/index.js",
   "types": "build/index.d.ts",
@@ -54,7 +54,7 @@
     "typescript-eslint": "^8.0.0"
   },
   "overrides": {
-    "qs": "6.14.2",
+    "qs": "6.16.0",
     "@cypress/request": "latest"
   },
   "author": {