verdaccio-security-filter 1.3.8 → 1.3.10

package/build/index.d.ts

@@ -6,6 +6,7 @@ export default class SecurityFilterPlugin implements IPluginMiddleware<SecurityC
     logger: SecurityLogger;
     config: SecurityConfig;
     private readonly securityRules;
+    private readonly blockedPatternRegexes;
     private readonly metrics;
     private readonly whitelistChecker;
     private readonly cveChecker;
@@ -20,7 +21,10 @@ export default class SecurityFilterPlugin implements IPluginMiddleware<SecurityC
     private _isScopeAllowed;
     private _getVersionRangeRule;
     register_middlewares(app: Application, _auth: IBasicAuth<SecurityConfig>, _storage: IStorageManager<SecurityConfig>): void;
+    private _blockedPackage;
+    private _removeVersions;
     filter_metadata(packageInfo: Package): Promise<Package>;
+    private _versionBlockReason;
     private _checkPackageBlock;
     private _getAppliedRules;
     destroy(): void;

package/build/index.js

@@ -47,6 +47,8 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthorChecker = exports.PackageAgeChecker = exports.LicenseChecker = exports.CVEChecker = exports.WhitelistChecker = exports.MetricsCollector = exports.SecurityLogger = void 0;
 const semver = __importStar(require("semver"));
+const fs_1 = require("fs");
+const path_1 = require("path");
 const logger_1 = require("./lib/logger");
 const metrics_1 = require("./lib/metrics");
 const whitelist_checker_1 = require("./lib/whitelist-checker");
@@ -54,6 +56,7 @@ const cve_checker_1 = require("./lib/cve-checker");
 const license_checker_1 = require("./lib/license-checker");
 const package_age_checker_1 = require("./lib/package-age-checker");
 const author_checker_1 = require("./lib/author-checker");
+const PLUGIN_VERSION = JSON.parse((0, fs_1.readFileSync)((0, path_1.join)(__dirname, '..', 'package.json'), 'utf8')).version;
 class SecurityFilterPlugin {
     constructor(config, options) {
         this.config = config || {};
@@ -81,6 +84,15 @@ class SecurityFilterPlugin {
             enforceChecksum: this.config.enforceChecksum !== false,
             versionRangeRules: this._parseVersionRangeRules(this.config.versionRangeRules || [])
         };
+        this.blockedPatternRegexes = this.securityRules.blockedPatterns.flatMap(pattern => {
+            try {
+                return [new RegExp(pattern)];
+            }
+            catch (error) {
+                this.logger.warn(`Invalid blocked pattern "${pattern}", skipping: ${error.message}`);
+                return [];
+            }
+        });
         this._logInitialization();
     }
     _parseVersionRangeRules(rules) {
@@ -89,9 +101,8 @@ class SecurityFilterPlugin {
                 this.logger.warn(`Invalid version range rule at index ${index}, skipping`);
                 return null;
             }
-            if (rule.strategy === 'fallback' && !rule.fallbackVersion) {
-                this.logger.warn(`Fallback strategy requires fallbackVersion for ${rule.package}, skipping`);
-                return null;
+            if (rule.strategy === 'fallback') {
+                this.logger.warn(`Strategy "fallback" for ${rule.package} is deprecated and works like "block": matching versions are hidden, so npm resolves to the highest allowed one`);
             }
             try {
                 const validRange = semver.validRange(rule.range);
@@ -156,10 +167,7 @@ class SecurityFilterPlugin {
         return features;
     }
     _isBlockedByPattern(packageName) {
-        return this.securityRules.blockedPatterns.some(pattern => {
-            const regex = new RegExp(pattern);
-            return regex.test(packageName);
-        });
+        return this.blockedPatternRegexes.some(regex => regex.test(packageName));
     }
     _isScopeAllowed(packageName) {
         if (!packageName.startsWith('@')) {
@@ -212,9 +220,11 @@ class SecurityFilterPlugin {
                 const tarballFile = urlMatch[3];
                 let version;
                 if (tarballFile) {
-                    const versionMatch = tarballFile.match(/-([\d.]+(?:-[a-zA-Z0-9.]+)?)\.tgz$/);
-                    version = versionMatch ? versionMatch[1] : undefined;
-                    this.logger.info(`[Middleware] TARBALL REQUEST: ${packageName}@${version || 'unknown'}`);
+                    const filePrefix = `${urlMatch[2]}-`;
+                    version = tarballFile.startsWith(filePrefix)
+                        ? tarballFile.slice(filePrefix.length, -'.tgz'.length)
+                        : undefined;
+                    this.logger.debug(`[Middleware] TARBALL REQUEST: ${packageName}@${version || 'unknown'}`);
                     const blockResult = yield this._checkPackageBlock(packageName, version);
                     if (blockResult.blocked) {
                         this.logger.warn(`[Middleware] [X] BLOCKED TARBALL: ${packageName}@${version || '*'} - ${blockResult.reason}`);
@@ -228,10 +238,10 @@ class SecurityFilterPlugin {
                         });
                         return;
                     }
-                    this.logger.info(`[Middleware] [OK] ALLOWED TARBALL: ${packageName}@${version || 'unknown'}`);
+                    this.logger.debug(`[Middleware] [OK] ALLOWED TARBALL: ${packageName}@${version || 'unknown'}`);
                 }
                 else {
-                    this.logger.info(`[Middleware] METADATA REQUEST: ${packageName} - will intercept response`);
+                    this.logger.debug(`[Middleware] METADATA REQUEST: ${packageName} - will intercept response`);
                     const blockResult = yield this._checkPackageBlock(packageName);
                     if (blockResult.blocked) {
                         this.logger.warn(`[Middleware] [X] BLOCKED METADATA: ${packageName} - ${blockResult.reason}`);
@@ -244,7 +254,7 @@ class SecurityFilterPlugin {
                                 reason: blockResult.reason,
                                 plugin: {
                                     name: 'verdaccio-security-filter',
-                                    version: '1.0.0',
+                                    version: PLUGIN_VERSION,
                                     mode: this.config.mode || 'blacklist',
                                 },
                                 blockedAt: new Date().toISOString(),
@@ -263,7 +273,7 @@ class SecurityFilterPlugin {
                         return;
                     }
                     else {
-                        this.logger.info(`[Middleware] [OK] ALLOWED METADATA: ${packageName}`);
+                        this.logger.debug(`[Middleware] [OK] ALLOWED METADATA: ${packageName}`);
                     }
                 }
                 next();
@@ -275,206 +285,176 @@ class SecurityFilterPlugin {
         }));
         this.logger.info('[Middleware] Security filter middleware registered successfully');
     }
+    _blockedPackage(pkg, reason, extra = {}) {
+        return Object.assign(Object.assign({}, pkg), { versions: {}, 'dist-tags': {}, security: Object.assign(Object.assign({ blocked: true, reason }, extra), { plugin: {
+                    name: 'verdaccio-security-filter',
+                    version: PLUGIN_VERSION,
+                    mode: this.config.mode || 'blacklist',
+                }, blockedAt: new Date().toISOString() }) });
+    }
+    _removeVersions(pkg, removed) {
+        if (removed.length === 0) {
+            return pkg;
+        }
+        const gone = new Set(removed);
+        const versions = Object.assign({}, pkg.versions);
+        for (const version of gone) {
+            delete versions[version];
+        }
+        const distTags = Object.assign({}, pkg['dist-tags']);
+        for (const [tag, tagVersion] of Object.entries(distTags)) {
+            if (gone.has(tagVersion)) {
+                delete distTags[tag];
+                this.logger.debug(`[filter_metadata] Removed dist-tag "${tag}" pointing to filtered version ${tagVersion}`);
+            }
+        }
+        return Object.assign(Object.assign({}, pkg), { versions, 'dist-tags': distTags });
+    }
     filter_metadata(packageInfo) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b, _c, _d, _e, _f, _g, _h;
+            var _a, _b, _c, _d, _e, _f, _g, _h, _j;
             let pkg = packageInfo;
             const packageName = pkg.name;
-            this.logger.info(`[filter_metadata] --> Processing: ${packageName}`);
+            this.logger.debug(`[filter_metadata] --> Processing: ${packageName}`);
             try {
                 const blockResult = yield this._checkPackageBlock(packageName);
                 if (blockResult.blocked) {
                     this.logger.warn(`[filter_metadata] BLOCKED: ${packageName}@* - ${blockResult.reason}`);
                     this.metrics.recordBlock(packageName, '*', blockResult.reason);
-                    return Object.assign(Object.assign({}, pkg), { versions: {}, 'dist-tags': {}, security: {
-                            blocked: true,
-                            reason: blockResult.reason,
-                            plugin: {
-                                name: 'verdaccio-security-filter',
-                                version: '2.0.0',
-                                mode: this.config.mode || 'blacklist',
-                            },
-                            blockedAt: new Date().toISOString(),
-                            rules: this._getAppliedRules(packageName),
-                        } });
+                    return this._blockedPackage(pkg, blockResult.reason, { rules: this._getAppliedRules(packageName) });
+                }
+                if (this.securityRules.blockedVersions.length > 0 || this.securityRules.versionRangeRules.length > 0) {
+                    const ruleBlocked = Object.keys(pkg.versions || {})
+                        .filter(version => this._versionBlockReason(packageName, version) !== null);
+                    if (ruleBlocked.length > 0) {
+                        this.logger.warn(`[filter_metadata] RULE FILTERED: ${packageName}: ${ruleBlocked.join(', ')}`);
+                        pkg = this._removeVersions(pkg, ruleBlocked);
+                    }
                 }
                 if ((_a = this.config.cveCheck) === null || _a === void 0 ? void 0 : _a.enabled) {
                     const versions = Object.keys(pkg.versions || {});
-                    const vulnerableVersions = [];
-                    const BATCH_SIZE = 10;
-                    for (let i = 0; i < versions.length; i += BATCH_SIZE) {
-                        const batch = versions.slice(i, i + BATCH_SIZE);
-                        const results = yield Promise.allSettled(batch.map(version => this.cveChecker.checkPackage(packageName, version)));
-                        results.forEach((result, index) => {
-                            if (result.status === 'fulfilled' && result.value.isVulnerable) {
-                                const version = batch[index];
-                                vulnerableVersions.push(version);
-                                this.logger.warn(`[filter_metadata] CVE found in ${packageName}@${version}: ${result.value.vulnerabilities.length} vulnerabilities`);
-                            }
-                            else if (result.status === 'rejected') {
-                                this.logger.error(`[filter_metadata] CVE check failed for ${packageName}@${batch[index]}: ${result.reason}`);
-                            }
-                        });
+                    let vulnerableVersions = [];
+                    try {
+                        const results = yield this.cveChecker.checkVersions(packageName, versions);
+                        vulnerableVersions = results.filter(result => result.isVulnerable).map(result => result.version);
+                    }
+                    catch (error) {
+                        this.logger.error(`[filter_metadata] CVE check failed for ${packageName}: ${error.message}`);
+                        if (((_b = this.config.errorHandling) === null || _b === void 0 ? void 0 : _b.onCveCheckError) === 'fail-closed') {
+                            const reason = `CVE check failed (fail-closed mode): ${error.message}`;
+                            this.metrics.recordBlock(packageName, '*', reason);
+                            return this._blockedPackage(pkg, reason);
+                        }
+                    }
+                    if (vulnerableVersions.length > 0 && !this.config.cveCheck.autoBlock) {
+                        this.logger.warn(`[filter_metadata] CVE found in ${packageName}: ${vulnerableVersions.length} vulnerable version(s), autoBlock is off`);
                     }
                     if (this.config.cveCheck.autoBlock && vulnerableVersions.length > 0) {
                         const reason = `Package has ${vulnerableVersions.length} vulnerable version(s)`;
                         if (vulnerableVersions.length === versions.length) {
                             this.logger.warn(`[filter_metadata] CVE BLOCKED: ${packageName} - ${reason}`);
                             this.metrics.recordBlock(packageName, '*', reason);
-                            return Object.assign(Object.assign({}, pkg), { versions: {}, 'dist-tags': {}, security: {
-                                    blocked: true,
-                                    reason,
-                                    vulnerableVersions,
-                                    plugin: {
-                                        name: 'verdaccio-security-filter',
-                                        version: '2.0.0',
-                                    },
-                                    blockedAt: new Date().toISOString(),
-                                } });
+                            return this._blockedPackage(pkg, reason, { vulnerableVersions });
                         }
                         this.logger.warn(`[filter_metadata] CVE FILTERED: ${packageName} - ${reason}: ${vulnerableVersions.join(', ')}`);
-                        const filteredVersions = Object.assign({}, pkg.versions);
                         for (const version of vulnerableVersions) {
-                            delete filteredVersions[version];
                             this.metrics.recordBlock(packageName, version, reason);
                         }
-                        const filteredDistTags = Object.assign({}, pkg['dist-tags']);
-                        for (const [tag, tagVersion] of Object.entries(filteredDistTags)) {
-                            if (vulnerableVersions.includes(tagVersion)) {
-                                delete filteredDistTags[tag];
-                                this.logger.debug(`[filter_metadata] Removed dist-tag "${tag}" pointing to vulnerable version ${tagVersion}`);
-                            }
-                        }
-                        pkg = Object.assign(Object.assign({}, pkg), { versions: filteredVersions, 'dist-tags': filteredDistTags });
+                        pkg = this._removeVersions(pkg, vulnerableVersions);
                     }
                 }
                 if (this.config.licenses && this.config.licenses.allowed && this.config.licenses.allowed.length > 0) {
-                    const latestVersion = (_b = pkg['dist-tags']) === null || _b === void 0 ? void 0 : _b.latest;
-                    if (latestVersion && ((_c = pkg.versions) === null || _c === void 0 ? void 0 : _c[latestVersion])) {
+                    const latestVersion = (_c = pkg['dist-tags']) === null || _c === void 0 ? void 0 : _c.latest;
+                    if (latestVersion && ((_d = pkg.versions) === null || _d === void 0 ? void 0 : _d[latestVersion])) {
                         const versionData = pkg.versions[latestVersion];
                         const licenseResult = this.licenseChecker.checkLicense(versionData);
                         if (!licenseResult.allowed) {
-                            this.logger.warn(`[filter_metadata] LICENSE BLOCKED: ${packageName} - ${licenseResult.reason}`);
-                            this.metrics.recordBlock(packageName, '*', licenseResult.reason || 'License not allowed');
-                            return Object.assign(Object.assign({}, pkg), { versions: {}, 'dist-tags': {}, security: {
-                                    blocked: true,
-                                    reason: licenseResult.reason || 'License not allowed',
-                                    license: licenseResult.license,
-                                    plugin: {
-                                        name: 'verdaccio-security-filter',
-                                        version: '2.0.0',
-                                    },
-                                    blockedAt: new Date().toISOString(),
-                                } });
+                            const reason = licenseResult.reason || 'License not allowed';
+                            this.logger.warn(`[filter_metadata] LICENSE BLOCKED: ${packageName} - ${reason}`);
+                            this.metrics.recordBlock(packageName, '*', reason);
+                            return this._blockedPackage(pkg, reason, { license: licenseResult.license });
                         }
                     }
                 }
-                if ((_d = this.config.packageAge) === null || _d === void 0 ? void 0 : _d.enabled) {
+                if ((_e = this.config.packageAge) === null || _e === void 0 ? void 0 : _e.enabled) {
                     const ageResult = this.packageAgeChecker.checkPackageAge(pkg);
                     if (!ageResult.allowed && !ageResult.warnOnly) {
-                        this.logger.warn(`[filter_metadata] AGE BLOCKED: ${packageName} - ${ageResult.reason}`);
-                        this.metrics.recordBlock(packageName, '*', ageResult.reason || 'Package too new');
-                        return Object.assign(Object.assign({}, pkg), { versions: {}, 'dist-tags': {}, security: {
-                                blocked: true,
-                                reason: ageResult.reason || 'Package too new',
-                                ageDays: ageResult.ageDays,
-                                plugin: {
-                                    name: 'verdaccio-security-filter',
-                                    version: '2.0.0',
-                                },
-                                blockedAt: new Date().toISOString(),
-                            } });
+                        const reason = ageResult.reason || 'Package too new';
+                        this.logger.warn(`[filter_metadata] AGE BLOCKED: ${packageName} - ${reason}`);
+                        this.metrics.recordBlock(packageName, '*', reason);
+                        return this._blockedPackage(pkg, reason, { ageDays: ageResult.ageDays });
                     }
                     else if (!ageResult.allowed && ageResult.warnOnly) {
                         this.logger.warn(`[filter_metadata] AGE WARNING: ${packageName} - ${ageResult.reason} (warn-only mode)`);
                     }
                     if (this.config.packageAge.minVersionAgeDays) {
-                        const filteredVersions = Object.assign({}, pkg.versions);
                         const removedVersions = [];
-                        for (const version of Object.keys(filteredVersions)) {
+                        for (const version of Object.keys(pkg.versions || {})) {
                             const versionAgeResult = this.packageAgeChecker.checkVersionAge(pkg, version);
                             if (!versionAgeResult.allowed && !versionAgeResult.warnOnly) {
                                 this.logger.warn(`[filter_metadata] VERSION AGE FILTERED: ${packageName}@${version} - ${versionAgeResult.reason}`);
                                 this.metrics.recordBlock(packageName, version, versionAgeResult.reason || 'Version too new');
-                                delete filteredVersions[version];
                                 removedVersions.push(version);
                             }
                             else if (!versionAgeResult.allowed && versionAgeResult.warnOnly) {
                                 this.logger.warn(`[filter_metadata] VERSION AGE WARNING: ${packageName}@${version} - ${versionAgeResult.reason} (warn-only mode)`);
                             }
                         }
-                        if (removedVersions.length > 0) {
-                            this.logger.info(`[filter_metadata] Removed ${removedVersions.length} too-new version(s) from ${packageName}: ${removedVersions.join(', ')}`);
-                            const filteredDistTags = Object.assign({}, pkg['dist-tags']);
-                            for (const [tag, tagVersion] of Object.entries(filteredDistTags)) {
-                                if (removedVersions.includes(tagVersion)) {
-                                    delete filteredDistTags[tag];
-                                    this.logger.debug(`[filter_metadata] Removed dist-tag "${tag}" pointing to filtered version ${tagVersion}`);
-                                }
-                            }
-                            pkg = Object.assign(Object.assign({}, pkg), { versions: filteredVersions, 'dist-tags': filteredDistTags });
-                        }
+                        pkg = this._removeVersions(pkg, removedVersions);
                     }
                 }
-                if ((_e = this.config.authorFilter) === null || _e === void 0 ? void 0 : _e.enabled) {
-                    const latestVersion = (_f = pkg['dist-tags']) === null || _f === void 0 ? void 0 : _f.latest;
-                    if (latestVersion && ((_g = pkg.versions) === null || _g === void 0 ? void 0 : _g[latestVersion])) {
+                if ((_f = this.config.authorFilter) === null || _f === void 0 ? void 0 : _f.enabled) {
+                    const latestVersion = (_g = pkg['dist-tags']) === null || _g === void 0 ? void 0 : _g.latest;
+                    if (latestVersion && ((_h = pkg.versions) === null || _h === void 0 ? void 0 : _h[latestVersion])) {
                         const versionData = pkg.versions[latestVersion];
                         const authorResult = this.authorChecker.checkAuthor(versionData);
                         if (!authorResult.allowed && !this.config.authorFilter.warnOnly) {
-                            this.logger.warn(`[filter_metadata] AUTHOR BLOCKED: ${packageName} - ${authorResult.reason}`);
+                            const reason = authorResult.reason || 'Author not allowed';
+                            this.logger.warn(`[filter_metadata] AUTHOR BLOCKED: ${packageName} - ${reason}`);
                             this.metrics.record({
                                 timestamp: new Date().toISOString(),
                                 event: 'author_blocked',
                                 packageName,
                                 version: latestVersion,
-                                reason: authorResult.reason || 'Author not allowed',
+                                reason,
                                 metadata: {
                                     blockedBy: authorResult.blockedBy,
                                     authorInfo: authorResult.authorInfo,
                                 },
                             });
-                            return Object.assign(Object.assign({}, pkg), { versions: {}, 'dist-tags': {}, security: {
-                                    blocked: true,
-                                    reason: authorResult.reason || 'Author not allowed',
-                                    blockedBy: authorResult.blockedBy,
-                                    authorInfo: authorResult.authorInfo,
-                                    plugin: {
-                                        name: 'verdaccio-security-filter',
-                                        version: '2.0.0',
-                                    },
-                                    blockedAt: new Date().toISOString(),
-                                } });
+                            return this._blockedPackage(pkg, reason, {
+                                blockedBy: authorResult.blockedBy,
+                                authorInfo: authorResult.authorInfo,
+                            });
                         }
                         else if (!authorResult.allowed && this.config.authorFilter.warnOnly) {
                             this.logger.warn(`[filter_metadata] AUTHOR WARNING: ${packageName} - ${authorResult.reason} (warn-only mode)`);
                         }
                     }
                 }
-                this.logger.info(`[filter_metadata] [OK] ALLOWED: ${packageName}`);
+                this.logger.debug(`[filter_metadata] [OK] ALLOWED: ${packageName}`);
                 return pkg;
             }
             catch (error) {
                 this.logger.error(`[filter_metadata] Error processing ${packageName}: ${error.message}`);
-                const errorStrategy = ((_h = this.config.errorHandling) === null || _h === void 0 ? void 0 : _h.onFilterError) || 'fail-open';
+                const errorStrategy = ((_j = this.config.errorHandling) === null || _j === void 0 ? void 0 : _j.onFilterError) || 'fail-open';
                 if (errorStrategy === 'fail-closed') {
                     this.logger.warn(`[filter_metadata] Error handling: fail-closed - BLOCKING ${packageName}`);
                     this.metrics.recordBlock(packageName, '*', `Error during processing: ${error.message}`);
-                    return Object.assign(Object.assign({}, packageInfo), { versions: {}, 'dist-tags': {}, security: {
-                            blocked: true,
-                            reason: `Error during security processing (fail-closed mode): ${error.message}`,
-                            plugin: {
-                                name: 'verdaccio-security-filter',
-                                version: '2.0.0',
-                            },
-                            blockedAt: new Date().toISOString(),
-                        } });
+                    return this._blockedPackage(packageInfo, `Error during security processing (fail-closed mode): ${error.message}`);
                 }
                 this.logger.warn(`[filter_metadata] Error handling: fail-open - ALLOWING ${packageName}`);
                 return packageInfo;
             }
         });
     }
+    _versionBlockReason(packageName, version) {
+        if (this.securityRules.blockedVersions.includes(`${packageName}@${version}`)) {
+            return 'Exact version match in blocklist';
+        }
+        const rangeRule = this._getVersionRangeRule(packageName, version);
+        return rangeRule ? `Version matches blocked range: ${rangeRule.range}` : null;
+    }
     _checkPackageBlock(packageName, version) {
         return __awaiter(this, void 0, void 0, function* () {
             if (this.config.mode === 'whitelist') {
@@ -489,15 +469,9 @@ class SecurityFilterPlugin {
             if (!this._isScopeAllowed(packageName)) {
                 return { blocked: true, reason: 'Package scope not allowed' };
             }
-            if (version) {
-                const versionKey = `${packageName}@${version}`;
-                if (this.securityRules.blockedVersions.includes(versionKey)) {
-                    return { blocked: true, reason: 'Exact version match in blocklist' };
-                }
-                const rangeRule = this._getVersionRangeRule(packageName, version);
-                if (rangeRule && rangeRule.strategy === 'block') {
-                    return { blocked: true, reason: `Version matches blocked range: ${rangeRule.range}` };
-                }
+            const versionReason = version ? this._versionBlockReason(packageName, version) : null;
+            if (versionReason) {
+                return { blocked: true, reason: versionReason };
             }
             return { blocked: false, reason: '' };
         });
@@ -508,11 +482,9 @@ class SecurityFilterPlugin {
             rules.mode = 'whitelist';
             rules.whitelisted = false;
         }
-        if (this._isBlockedByPattern(packageName)) {
-            rules.blockedPattern = this.securityRules.blockedPatterns.find(pattern => {
-                const regex = new RegExp(pattern);
-                return regex.test(packageName);
-            });
+        const blockedPattern = this.blockedPatternRegexes.find(regex => regex.test(packageName));
+        if (blockedPattern) {
+            rules.blockedPattern = blockedPattern.source;
         }
         if (packageName.startsWith('@')) {
             const scope = packageName.split('/')[0];

package/build/lib/cve-checker.d.ts

@@ -2,22 +2,29 @@ import { CVECheckConfig, CVECheckResult } from '../types';
 export declare class CVEChecker {
     private config;
     private cache;
-    private lastUpdate;
+    private failedUntil;
+    private inFlight;
+    private matches;
     private readonly MAX_CACHE_SIZE;
     private saveTimer;
     private readonly SAVE_DEBOUNCE_MS;
+    private dirty;
     constructor(config?: CVECheckConfig);
     checkPackage(packageName: string, version: string): Promise<CVECheckResult>;
-    private fetchVulnerabilities;
+    checkVersions(packageName: string, versions: string[]): Promise<CVECheckResult[]>;
+    private getPackageEntry;
+    private refresh;
     private fetchFromOSV;
-    private sleep;
+    private queryOSV;
+    private toCachedVulnerability;
     private mapOSVSeverity;
     private mapDatabaseSpecificSeverity;
     private scoreToSeverity;
     private computeCVSSv3BaseScore;
-    private isCacheStale;
+    private get cacheFile();
     private loadCache;
     private debouncedSaveCache;
+    private serializeCache;
     private saveCache;
     clearCache(): void;
     destroy(): void;

package/build/lib/cve-checker.js

@@ -45,6 +45,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CVEChecker = void 0;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
+const semver = __importStar(require("semver"));
 const lru_cache_1 = require("./lru-cache");
 const CVSS_V3_WEIGHTS = {
     AV: { N: 0.85, A: 0.62, L: 0.55, P: 0.2 },
@@ -61,12 +62,56 @@ function roundUpCvssScore(value) {
     }
     return (Math.floor(intValue / 10000) + 1) / 10;
 }
+const OSV_QUERY_URL = 'https://api.osv.dev/v1/query';
+const OSV_TIMEOUT_MS = 5000;
+const OSV_ATTEMPTS = 2;
+const OSV_RETRY_DELAY_MS = 500;
+const FAILURE_TTL_MS = 60000;
+function compareVersions(a, b) {
+    try {
+        return semver.compare(a, b);
+    }
+    catch (_a) {
+        return NaN;
+    }
+}
+function isInRange(events, version) {
+    let affected = false;
+    for (const event of events) {
+        if (event.introduced !== undefined) {
+            if (event.introduced === '0' || compareVersions(version, event.introduced) >= 0)
+                affected = true;
+        }
+        else if (event.fixed !== undefined) {
+            if (compareVersions(version, event.fixed) >= 0)
+                affected = false;
+        }
+        else if (event.last_affected !== undefined) {
+            if (compareVersions(version, event.last_affected) > 0)
+                affected = false;
+        }
+    }
+    return affected;
+}
+function isAffected(vuln, version, parsed) {
+    const informative = vuln.affected.filter(a => a.versions || a.ranges.length > 0);
+    if (informative.length === 0) {
+        return true;
+    }
+    return informative.some(a => {
+        var _a;
+        return ((_a = a.versions) === null || _a === void 0 ? void 0 : _a.includes(version)) ||
+            (parsed !== null && a.ranges.some(events => isInRange(events, parsed)));
+    });
+}
 class CVEChecker {
     constructor(config) {
-        this.lastUpdate = 0;
+        this.inFlight = new Map();
+        this.matches = new WeakMap();
         this.MAX_CACHE_SIZE = 1000;
         this.saveTimer = null;
         this.SAVE_DEBOUNCE_MS = 5000;
+        this.dirty = false;
         this.config = {
             enabled: (config === null || config === void 0 ? void 0 : config.enabled) || false,
             databases: (config === null || config === void 0 ? void 0 : config.databases) || ['osv'],
@@ -76,131 +121,156 @@ class CVEChecker {
             cacheDir: (config === null || config === void 0 ? void 0 : config.cacheDir) || './.security-cache',
         };
         this.cache = new lru_cache_1.LRUCache(this.MAX_CACHE_SIZE);
+        this.failedUntil = new lru_cache_1.LRUCache(this.MAX_CACHE_SIZE);
         if (this.config.enabled) {
             this.loadCache();
         }
     }
     checkPackage(packageName, version) {
         return __awaiter(this, void 0, void 0, function* () {
-            if (!this.config.enabled) {
-                return {
+            return (yield this.checkVersions(packageName, [version]))[0];
+        });
+    }
+    checkVersions(packageName, versions) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const checkedAt = new Date().toISOString();
+            if (!this.config.enabled || !this.config.databases.includes('osv')) {
+                return versions.map(version => ({
                     package: packageName,
                     version,
                     vulnerabilities: [],
                     isVulnerable: false,
-                    checkedAt: new Date().toISOString(),
-                };
+                    checkedAt,
+                }));
             }
-            const cacheKey = `${packageName}@${version}`;
-            if (this.cache.has(cacheKey) && !this.isCacheStale()) {
-                return this.cache.get(cacheKey);
+            const entry = yield this.getPackageEntry(packageName);
+            let memo = this.matches.get(entry);
+            if (!memo) {
+                memo = new Map();
+                this.matches.set(entry, memo);
             }
-            const vulnerabilities = yield this.fetchVulnerabilities(packageName, version);
-            const filteredVulnerabilities = vulnerabilities.filter(vuln => this.config.severity.includes(vuln.severity));
-            const result = {
-                package: packageName,
-                version,
-                vulnerabilities: filteredVulnerabilities,
-                isVulnerable: filteredVulnerabilities.length > 0,
-                checkedAt: new Date().toISOString(),
-            };
-            this.cache.set(cacheKey, result);
-            this.debouncedSaveCache();
-            return result;
+            const relevant = entry.vulns.filter(vuln => this.config.severity.includes(vuln.severity));
+            return versions.map(version => {
+                let vulnerabilities = memo.get(version);
+                if (!vulnerabilities) {
+                    const parsed = semver.parse(version);
+                    vulnerabilities = relevant.filter(vuln => isAffected(vuln, version, parsed));
+                    memo.set(version, vulnerabilities);
+                }
+                return {
+                    package: packageName,
+                    version,
+                    vulnerabilities,
+                    isVulnerable: vulnerabilities.length > 0,
+                    checkedAt,
+                };
+            });
         });
     }
-    fetchVulnerabilities(packageName, version) {
+    getPackageEntry(packageName) {
+        const cached = this.cache.get(packageName);
+        const ttlMs = this.config.updateInterval * 60 * 60 * 1000;
+        if (cached && Date.now() - cached.checkedAt <= ttlMs) {
+            return Promise.resolve(cached);
+        }
+        let pending = this.inFlight.get(packageName);
+        if (!pending) {
+            pending = this.refresh(packageName, cached).finally(() => this.inFlight.delete(packageName));
+            this.inFlight.set(packageName, pending);
+        }
+        return pending;
+    }
+    refresh(packageName, stale) {
         return __awaiter(this, void 0, void 0, function* () {
-            const vulnerabilities = [];
-            for (const database of this.config.databases) {
+            var _a;
+            let failure;
+            if (((_a = this.failedUntil.get(packageName)) !== null && _a !== void 0 ? _a : 0) > Date.now()) {
+                failure = new Error('OSV lookup failed recently, not retrying yet');
+            }
+            else {
                 try {
-                    switch (database) {
-                        case 'osv':
-                            vulnerabilities.push(...yield this.fetchFromOSV(packageName, version));
-                            break;
-                        case 'snyk':
-                            break;
-                        case 'github':
-                            break;
-                    }
+                    const entry = { checkedAt: Date.now(), vulns: yield this.fetchFromOSV(packageName) };
+                    this.cache.set(packageName, entry);
+                    this.failedUntil.delete(packageName);
+                    this.debouncedSaveCache();
+                    return entry;
                 }
                 catch (error) {
-                    const message = error instanceof Error ? error.message : String(error);
-                    console.error(`[CVE Checker] Error fetching from ${database}:`, message);
+                    failure = error;
+                    this.failedUntil.set(packageName, Date.now() + FAILURE_TTL_MS);
                 }
             }
-            return vulnerabilities;
+            if (stale) {
+                const message = failure instanceof Error ? failure.message : String(failure);
+                console.warn(`[CVE Checker] Using stale data for ${packageName}: ${message}`);
+                return stale;
+            }
+            throw failure;
         });
     }
-    fetchFromOSV(packageName, version) {
+    fetchFromOSV(packageName) {
         return __awaiter(this, void 0, void 0, function* () {
-            const maxRetries = 3;
-            const retryDelay = 1000;
-            for (let attempt = 1; attempt <= maxRetries; attempt++) {
+            const vulns = [];
+            let pageToken;
+            do {
+                const data = yield this.queryOSV({
+                    package: { name: packageName, ecosystem: 'npm' },
+                    page_token: pageToken,
+                });
+                for (const vuln of data.vulns || []) {
+                    vulns.push(this.toCachedVulnerability(vuln, packageName));
+                }
+                pageToken = data.next_page_token;
+            } while (pageToken);
+            return vulns;
+        });
+    }
+    queryOSV(body) {
+        return __awaiter(this, void 0, void 0, function* () {
+            for (let attempt = 1;; attempt++) {
                 try {
-                    const controller = new AbortController();
-                    const timeoutId = setTimeout(() => controller.abort(), 10000);
-                    const response = yield fetch('https://api.osv.dev/v1/query', {
+                    const response = yield fetch(OSV_QUERY_URL, {
                         method: 'POST',
-                        headers: {
-                            'Content-Type': 'application/json',
-                        },
-                        body: JSON.stringify({
-                            package: {
-                                name: packageName,
-                                ecosystem: 'npm',
-                            },
-                            version: version,
-                        }),
-                        signal: controller.signal,
+                        headers: { 'Content-Type': 'application/json' },
+                        body: JSON.stringify(body),
+                        signal: AbortSignal.timeout(OSV_TIMEOUT_MS),
                     });
-                    clearTimeout(timeoutId);
                     if (!response.ok) {
-                        if (response.status === 429 && attempt < maxRetries) {
-                            const waitTime = retryDelay * Math.pow(2, attempt - 1);
-                            console.warn(`[CVE Checker] Rate limited, retrying in ${waitTime}ms (attempt ${attempt}/${maxRetries})`);
-                            yield this.sleep(waitTime);
-                            continue;
-                        }
                         throw new Error(`OSV API returned ${response.status}`);
                     }
-                    const data = yield response.json();
-                    if (!data.vulns || data.vulns.length === 0) {
-                        return [];
-                    }
-                    return data.vulns.map((vuln) => {
-                        var _a, _b, _c, _d, _e, _f, _g;
-                        return ({
-                            id: vuln.id,
-                            severity: this.mapOSVSeverity(vuln),
-                            summary: vuln.summary || vuln.details || 'No description available',
-                            affectedVersions: ((_a = vuln.affected) === null || _a === void 0 ? void 0 : _a.map((a) => { var _a; return (_a = a.ranges) === null || _a === void 0 ? void 0 : _a.map((r) => { var _a; return (_a = r.events) === null || _a === void 0 ? void 0 : _a.map((e) => e.introduced || e.fixed).filter(Boolean); }).flat(); }).flat()) || [],
-                            fixedVersion: (_g = (_f = (_e = (_d = (_c = (_b = vuln.affected) === null || _b === void 0 ? void 0 : _b[0]) === null || _c === void 0 ? void 0 : _c.ranges) === null || _d === void 0 ? void 0 : _d[0]) === null || _e === void 0 ? void 0 : _e.events) === null || _f === void 0 ? void 0 : _f.find((e) => e.fixed)) === null || _g === void 0 ? void 0 : _g.fixed,
-                            publishedDate: vuln.published || new Date().toISOString(),
-                            source: 'osv',
-                        });
-                    });
+                    return yield response.json();
                 }
                 catch (error) {
-                    const message = error instanceof Error ? error.message : String(error);
-                    if (attempt === maxRetries) {
-                        console.error(`[CVE Checker] OSV API error after ${maxRetries} attempts:`, message);
-                        return [];
+                    if (attempt >= OSV_ATTEMPTS) {
+                        throw error;
                     }
-                    if (error instanceof Error && error.name === 'AbortError') {
-                        console.warn(`[CVE Checker] Request timeout, retrying (attempt ${attempt}/${maxRetries})`);
-                    }
-                    else {
-                        console.warn(`[CVE Checker] Request failed, retrying (attempt ${attempt}/${maxRetries}):`, message);
-                    }
-                    yield this.sleep(retryDelay * attempt);
+                    yield new Promise(resolve => setTimeout(resolve, OSV_RETRY_DELAY_MS));
                 }
             }
-            return [];
         });
     }
-    sleep(ms) {
-        return new Promise(resolve => setTimeout(resolve, ms));
+    toCachedVulnerability(vuln, packageName) {
+        var _a;
+        const affected = (vuln.affected || [])
+            .filter(a => { var _a; return !((_a = a.package) === null || _a === void 0 ? void 0 : _a.name) || a.package.name === packageName; })
+            .map(a => {
+            var _a;
+            return ({
+                versions: ((_a = a.versions) === null || _a === void 0 ? void 0 : _a.length) ? a.versions : undefined,
+                ranges: (a.ranges || []).filter(r => r.type !== 'GIT').map(r => r.events || []),
+            });
+        });
+        const events = affected.flatMap(a => a.ranges.flat());
+        return {
+            id: vuln.id || 'unknown',
+            severity: this.mapOSVSeverity(vuln),
+            summary: vuln.summary || 'No description available',
+            affectedVersions: events.map(e => e.introduced || e.fixed).filter((v) => !!v),
+            fixedVersion: (_a = events.find(e => e.fixed)) === null || _a === void 0 ? void 0 : _a.fixed,
+            publishedDate: vuln.published || new Date().toISOString(),
+            source: 'osv',
+            affected,
+        };
     }
     mapOSVSeverity(vuln) {
         var _a, _b, _c, _d;
@@ -279,23 +349,21 @@ class CVEChecker {
             ? Math.ceil(cappedScore * 10) / 10
             : roundUpCvssScore(cappedScore);
     }
-    isCacheStale() {
-        const now = Date.now();
-        const updateIntervalMs = this.config.updateInterval * 60 * 60 * 1000;
-        return now - this.lastUpdate > updateIntervalMs;
+    get cacheFile() {
+        return path.join(this.config.cacheDir, 'cve-cache.json');
     }
     loadCache() {
         try {
-            const cacheFile = path.join(this.config.cacheDir, 'cve-cache.json');
-            if (fs.existsSync(cacheFile)) {
-                const data = fs.readFileSync(cacheFile, 'utf8');
-                const parsed = JSON.parse(data);
-                const entries = Object.entries(parsed.cache);
-                const sortedEntries = entries.slice(-this.MAX_CACHE_SIZE);
-                sortedEntries.forEach(([key, value]) => {
-                    this.cache.set(key, value);
-                });
-                this.lastUpdate = parsed.lastUpdate || 0;
+            if (!fs.existsSync(this.cacheFile)) {
+                return;
+            }
+            const parsed = JSON.parse(fs.readFileSync(this.cacheFile, 'utf8'));
+            for (const [key, value] of Object.entries((parsed === null || parsed === void 0 ? void 0 : parsed.cache) || {}).slice(-this.MAX_CACHE_SIZE)) {
+                const entry = value;
+                if (typeof (entry === null || entry === void 0 ? void 0 : entry.checkedAt) === 'number' && Array.isArray(entry.vulns)
+                    && entry.vulns.every(vuln => Array.isArray(vuln === null || vuln === void 0 ? void 0 : vuln.affected))) {
+                    this.cache.set(key, entry);
+                }
             }
         }
         catch (error) {
@@ -304,44 +372,54 @@ class CVEChecker {
         }
     }
     debouncedSaveCache() {
+        this.dirty = true;
         if (this.saveTimer) {
             clearTimeout(this.saveTimer);
         }
         this.saveTimer = setTimeout(() => {
-            this.saveCache();
             this.saveTimer = null;
+            void this.saveCache();
         }, this.SAVE_DEBOUNCE_MS);
+        this.saveTimer.unref();
+    }
+    serializeCache() {
+        return JSON.stringify({ cache: Object.fromEntries(this.cache.entries()) });
     }
     saveCache() {
-        try {
-            const cacheFile = path.join(this.config.cacheDir, 'cve-cache.json');
-            const dir = path.dirname(cacheFile);
-            if (!fs.existsSync(dir)) {
-                fs.mkdirSync(dir, { recursive: true });
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                this.dirty = false;
+                const tmpFile = `${this.cacheFile}.${process.pid}.tmp`;
+                yield fs.promises.mkdir(path.dirname(this.cacheFile), { recursive: true });
+                yield fs.promises.writeFile(tmpFile, this.serializeCache(), 'utf8');
+                yield fs.promises.rename(tmpFile, this.cacheFile);
             }
-            const data = {
-                cache: Object.fromEntries(this.cache.entries()),
-                lastUpdate: Date.now(),
-            };
-            fs.writeFileSync(cacheFile, JSON.stringify(data, null, 2), 'utf8');
-            this.lastUpdate = Date.now();
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            console.error('[CVE Checker] Failed to save cache:', message);
-        }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                console.error('[CVE Checker] Failed to save cache:', message);
+            }
+        });
     }
     clearCache() {
         this.cache.clear();
-        this.lastUpdate = 0;
-        this.saveCache();
+        this.failedUntil.clear();
+        this.debouncedSaveCache();
     }
     destroy() {
         if (this.saveTimer) {
             clearTimeout(this.saveTimer);
             this.saveTimer = null;
         }
-        this.saveCache();
+        if (this.dirty) {
+            try {
+                fs.mkdirSync(path.dirname(this.cacheFile), { recursive: true });
+                fs.writeFileSync(this.cacheFile, this.serializeCache(), 'utf8');
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                console.error('[CVE Checker] Failed to save cache:', message);
+            }
+        }
         this.cache.clear();
     }
 }

package/build/lib/metrics.d.ts

@@ -4,6 +4,8 @@ export declare class MetricsCollector {
     private metricsBuffer;
     private readonly bufferSize;
     private readonly maxBufferSize;
+    private readonly flushIntervalMs;
+    private flushTimer;
     constructor(config?: MetricsConfig);
     record(event: MetricsData): void;
     recordBlock(packageName: string, version: string, reason: string, metadata?: Record<string, any>): void;

package/build/lib/metrics.js

@@ -41,11 +41,17 @@ class MetricsCollector {
         this.metricsBuffer = [];
         this.bufferSize = 100;
         this.maxBufferSize = 500;
+        this.flushIntervalMs = 10000;
+        this.flushTimer = null;
         this.config = {
             enabled: (config === null || config === void 0 ? void 0 : config.enabled) || false,
             output: (config === null || config === void 0 ? void 0 : config.output) || 'stdout',
             filePath: (config === null || config === void 0 ? void 0 : config.filePath) || './security-metrics.json',
         };
+        if (this.config.enabled) {
+            this.flushTimer = setInterval(() => this.flush(), this.flushIntervalMs);
+            this.flushTimer.unref();
+        }
     }
     record(event) {
         if (!this.config.enabled) {
@@ -163,6 +169,10 @@ class MetricsCollector {
         return summary;
     }
     cleanup() {
+        if (this.flushTimer) {
+            clearInterval(this.flushTimer);
+            this.flushTimer = null;
+        }
         this.flush();
     }
 }

package/build/lib/whitelist-checker.d.ts

@@ -1,12 +1,14 @@
 import { WhitelistConfig } from '../types';
 export declare class WhitelistChecker {
     private config;
+    private regexes;
     constructor(config?: WhitelistConfig);
     isWhitelisted(packageName: string, version?: string): {
         allowed: boolean;
         reason?: string;
     };
     private matchesPattern;
+    private compile;
     addPackage(packageName: string, versionRange?: string): void;
     removePackage(packageName: string): void;
     addPattern(pattern: string): void;

package/build/lib/whitelist-checker.js

@@ -46,6 +46,7 @@ exports.WhitelistChecker = void 0;
 const semver = __importStar(require("semver"));
 class WhitelistChecker {
     constructor(config) {
+        this.regexes = new Map();
         this.config = {
             packages: (config === null || config === void 0 ? void 0 : config.packages) || [],
             patterns: (config === null || config === void 0 ? void 0 : config.patterns) || [],
@@ -75,16 +76,21 @@ class WhitelistChecker {
         };
     }
     matchesPattern(packageName) {
-        return this.config.patterns.some(pattern => {
+        return this.config.patterns.some(pattern => { var _a; return (_a = this.compile(pattern)) === null || _a === void 0 ? void 0 : _a.test(packageName); });
+    }
+    compile(pattern) {
+        let regex = this.regexes.get(pattern);
+        if (regex === undefined) {
             try {
-                const regex = new RegExp(pattern);
-                return regex.test(packageName);
+                regex = new RegExp(pattern);
             }
             catch (_a) {
                 console.error(`[Whitelist] Invalid pattern: ${pattern}`);
-                return false;
+                regex = null;
             }
-        });
+            this.regexes.set(pattern, regex);
+        }
+        return regex;
     }
     addPackage(packageName, versionRange) {
         if (!this.config.packages.includes(packageName)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "verdaccio-security-filter",
-  "version": "1.3.8",
+  "version": "1.3.10",
   "description": "Advanced security filter plugin for Verdaccio with version range blocking and fallback strategies",
   "main": "build/index.js",
   "types": "build/index.d.ts",