verdaccio-security-filter 1.3.9 → 1.3.11

package/README.md

@@ -36,17 +36,15 @@ This plugin implements **two independent security layers** for complete protecti
 
 #### 🔒 Version Management
 - **Version Range Blocking** - Block vulnerable versions using semver ranges
-  - **Block Strategy**: Completely remove versions from registry
-  - **Fallback Strategy**: Transparently redirect to safe versions
+  - Matching versions are hidden from metadata and their tarballs return 403, so npm resolves to the highest allowed version
 - **Exact Version Blocking** - Block specific package@version combinations
 - **Semver Support** - Full semver syntax (`^`, `~`, `>`, `>=`, `<`, `<=`, `x`, `*`)
 
 #### 🛡️ CVE & Vulnerability Scanning
 - **OSV Database Integration** - Automatic vulnerability scanning via [OSV API](https://osv.dev/)
 - **Severity Filtering** - Filter by severity: `low`, `medium`, `high`, `critical`
-- **Auto-Block Vulnerable Packages** - Automatically block packages with known CVEs
-- **Caching System** - Configurable cache with update intervals
-- **Multiple Database Support** - Ready for OSV, Snyk, GitHub Advisory
+- **Auto-Block Vulnerable Versions** - Remove versions with known CVEs from metadata
+- **Caching System** - One OSV lookup per package, cached per package with a configurable refresh interval
 
 #### ⚖️ License Compliance
 - **License Filtering** - Enforce license policies with allowed/blocked lists
@@ -62,7 +60,7 @@ This plugin implements **two independent security layers** for complete protecti
 
 #### 📊 Monitoring & Observability
 - **Enhanced Logging** - Configurable log levels (`debug`, `info`, `warn`, `error`)
-- **Metrics Collection** - Track security events (blocks, fallbacks, CVEs, license violations)
+- **Metrics Collection** - Track security events (blocks with their reason, author blocks)
 - **Security Audit Trail** - Detailed logging of all security decisions
 - **Customizable Output** - Log to stdout or file in JSON format
 
@@ -83,9 +81,7 @@ This plugin implements **two independent security layers** for complete protecti
   - Prevents blocked packages from being installed as dependencies
   - Intercepts requests to `/:package/-/:filename.tgz` routes
   - Returns 403 Forbidden with detailed error messages
-- **Size Limits** - Enforce minimum and maximum package sizes
 - **Metadata Validation** - Verify package integrity and detect dangerous characters
-- **Checksum Enforcement** - Ensure package integrity
 
 #### ⚙️ Reliability & Error Handling
 - **Fail-Safe/Fail-Closed Configuration** - Choose error handling strategy
@@ -274,7 +270,6 @@ filters:
       enabled: true
       databases:
         - osv
-        - github
       severity:
         - high
         - critical
@@ -304,8 +299,7 @@ filters:
     versionRangeRules:
       - package: lodash
         range: "<4.17.21"
-        strategy: fallback
-        fallbackVersion: "4.17.21"
+        strategy: block
         reason: "CVE-2021-23337: Command injection"
 
       - package: minimist
@@ -379,7 +373,7 @@ filters:
 
     cveCheck:
       enabled: true
-      databases: [osv, github, snyk]
+      databases: [osv]
       severity: [low, medium, high, critical]  # Block ALL
       autoBlock: true
       updateInterval: 6                         # Check every 6 hours
@@ -389,9 +383,6 @@ filters:
       blocked: [GPL-3.0, AGPL-3.0, LGPL-3.0]
       requireLicense: true
 
-    minPackageSize: 10000      # 10KB minimum
-    maxPackageSize: 10485760   # 10MB maximum
-
     logger:
       level: debug             # Log everything
       enabled: true
@@ -419,23 +410,22 @@ middlewares:
 | `blockedPatterns` | `string[]` | `[]` | Regex patterns for package names |
 | `allowedScopes` | `string[]` | `[]` | Allowed package scopes |
 | `blockedScopes` | `string[]` | `[]` | Blocked package scopes |
-| `minPackageSize` | `number` | `0` | Minimum package size in bytes |
-| `maxPackageSize` | `number` | `104857600` | Maximum package size (100MB) |
-| `enforceChecksum` | `boolean` | `true` | Enforce checksum validation |
 
 ### CVE Check Options
 
 | Option | Type | Default | Description |
 |--------|------|---------|-------------|
 | `cveCheck.enabled` | `boolean` | `false` | Enable CVE scanning |
-| `cveCheck.databases` | `string[]` | `['osv']` | Databases: `osv`, `snyk`, `github` |
+| `cveCheck.databases` | `string[]` | `['osv']` | Vulnerability databases. Only `osv` is implemented; it already includes GitHub Security Advisories |
 | `cveCheck.severity` | `string[]` | `['high', 'critical']` | Severity levels to check |
 | `cveCheck.autoBlock` | `boolean` | `false` | Remove vulnerable versions from metadata (whole package blocked if every version is vulnerable) |
-| `cveCheck.updateInterval` | `number` | `24` | Cache update interval (hours) |
+| `cveCheck.updateInterval` | `number` | `24` | How long a package's vulnerability data is cached (hours) |
 | `cveCheck.cacheDir` | `string` | `./.security-cache` | Cache directory path |
 
 > **Note on `autoBlock` and dist-tags:** only the vulnerable versions are removed; unaffected versions stay installable. Any dist-tag (including `latest`) that points to a removed version is dropped and **not** re-pointed to another version. If `latest` is vulnerable, `npm install <pkg>` without a version or range will fail - install an explicit safe version or range instead (e.g. `npm install <pkg>@^1.2.0`).
 
+> **When OSV is unreachable:** a lookup gets one retry with a 5 second timeout each. After a failure the same package is not looked up again for 60 seconds. Previously cached data, even if older than `updateInterval`, keeps being used. With no cached data, `errorHandling.onCveCheckError` decides: `fail-open` serves the package unchecked, `fail-closed` blocks it.
+
 ### License Options
 
 | Option | Type | Default | Description |
@@ -496,8 +486,7 @@ middlewares:
 | Option | Type | Default | Description |
 |--------|------|---------|-------------|
 | `errorHandling.onFilterError` | `'fail-open' \| 'fail-closed'` | `'fail-open'` | Strategy when filter errors occur |
-| `errorHandling.onCveCheckError` | `'fail-open' \| 'fail-closed'` | `'fail-open'` | Strategy when CVE check fails |
-| `errorHandling.onLicenseCheckError` | `'fail-open' \| 'fail-closed'` | `'fail-open'` | Strategy when license check fails |
+| `errorHandling.onCveCheckError` | `'fail-open' \| 'fail-closed'` | `'fail-open'` | Strategy when the vulnerability lookup fails and no cached data exists |
 
 **Error Handling Strategies:**
 - **fail-open** (Default): Allow packages through on errors (prioritizes availability)
@@ -509,19 +498,16 @@ middlewares:
 errorHandling:
   onFilterError: fail-closed
   onCveCheckError: fail-closed
-  onLicenseCheckError: fail-closed
 
 # Development: Availability-first approach
 errorHandling:
   onFilterError: fail-open
   onCveCheckError: fail-open
-  onLicenseCheckError: fail-open
 
-# Balanced: Block only on license failures
+# Balanced: block only when vulnerability data is unavailable
 errorHandling:
   onFilterError: fail-open
-  onCveCheckError: fail-open
-  onLicenseCheckError: fail-closed
+  onCveCheckError: fail-closed
 ```
 
 ### Version Range Rules
@@ -530,8 +516,7 @@ errorHandling:
 {
   package: string;           // Package name
   range: string;             // Semver range
-  strategy: 'block' | 'fallback';
-  fallbackVersion?: string;  // Required for fallback strategy
+  strategy: 'block';         // 'fallback' is deprecated and behaves like 'block'
   reason?: string;           // Explanation for blocking
 }
 ```
@@ -586,12 +571,7 @@ npm run build -- --watch
 
 When metrics are enabled, the plugin tracks:
 
-- `block` - Packages blocked by version/pattern/scope rules
-- `fallback` - Versions redirected to safe alternatives
-- `publish_rejected` - Publish attempts rejected
-- `cve_detected` - CVE vulnerabilities found
-- `license_blocked` - Packages blocked by license rules
-- `package_too_new` - Packages/versions blocked due to age restrictions
+- `block` - Packages or versions blocked by rules, CVE, license or age checks; the `reason` field says which
 - `author_blocked` - Packages blocked due to author/region filtering
 
 Example metrics output:
@@ -621,17 +601,18 @@ versionRangeRules:
     reason: "CVE-2021-23337: Command injection vulnerability"
 ```
 
-### 2. Transparent Security Patches (Fallback)
+### 2. Steer Installs to a Patched Version
 
 ```yaml
 versionRangeRules:
   - package: axios
     range: "0.21.1"
-    strategy: fallback
-    fallbackVersion: "0.21.4"
+    strategy: block
     reason: "SSRF vulnerability fix"
 ```
 
+The blocked version disappears from the package metadata, so a range such as `axios@^0.21.0` resolves to the newest allowed version. A lockfile pinned to the blocked version fails with 403 until it is updated.
+
 ### 3. Enforce Corporate License Policy
 
 ```yaml
@@ -665,7 +646,7 @@ whitelist:
 ```yaml
 cveCheck:
   enabled: true
-  databases: [osv, github]
+  databases: [osv]
   severity: [high, critical]
   autoBlock: true
   updateInterval: 12

package/build/index.d.ts

@@ -6,6 +6,7 @@ export default class SecurityFilterPlugin implements IPluginMiddleware<SecurityC
     logger: SecurityLogger;
     config: SecurityConfig;
     private readonly securityRules;
+    private readonly blockedPatternRegexes;
     private readonly metrics;
     private readonly whitelistChecker;
     private readonly cveChecker;
@@ -20,7 +21,10 @@ export default class SecurityFilterPlugin implements IPluginMiddleware<SecurityC
     private _isScopeAllowed;
     private _getVersionRangeRule;
     register_middlewares(app: Application, _auth: IBasicAuth<SecurityConfig>, _storage: IStorageManager<SecurityConfig>): void;
+    private _blockedPackage;
+    private _removeVersions;
     filter_metadata(packageInfo: Package): Promise<Package>;
+    private _versionBlockReason;
     private _checkPackageBlock;
     private _getAppliedRules;
     destroy(): void;

package/build/index.js

@@ -47,6 +47,8 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthorChecker = exports.PackageAgeChecker = exports.LicenseChecker = exports.CVEChecker = exports.WhitelistChecker = exports.MetricsCollector = exports.SecurityLogger = void 0;
 const semver = __importStar(require("semver"));
+const fs_1 = require("fs");
+const path_1 = require("path");
 const logger_1 = require("./lib/logger");
 const metrics_1 = require("./lib/metrics");
 const whitelist_checker_1 = require("./lib/whitelist-checker");
@@ -54,6 +56,7 @@ const cve_checker_1 = require("./lib/cve-checker");
 const license_checker_1 = require("./lib/license-checker");
 const package_age_checker_1 = require("./lib/package-age-checker");
 const author_checker_1 = require("./lib/author-checker");
+const PLUGIN_VERSION = JSON.parse((0, fs_1.readFileSync)((0, path_1.join)(__dirname, '..', 'package.json'), 'utf8')).version;
 class SecurityFilterPlugin {
     constructor(config, options) {
         this.config = config || {};
@@ -61,7 +64,6 @@ class SecurityFilterPlugin {
             this.config.errorHandling = {
                 onFilterError: 'fail-open',
                 onCveCheckError: 'fail-open',
-                onLicenseCheckError: 'fail-open',
             };
         }
         this.logger = new logger_1.SecurityLogger(options.logger, this.config.logger);
@@ -74,13 +76,19 @@ class SecurityFilterPlugin {
         this.securityRules = {
             blockedVersions: this.config.blockedVersions || [],
             blockedPatterns: this.config.blockedPatterns || [],
-            minPackageSize: this.config.minPackageSize || 0,
-            maxPackageSize: this.config.maxPackageSize || 100 * 1024 * 1024,
             allowedScopes: this.config.allowedScopes || [],
             blockedScopes: this.config.blockedScopes || [],
-            enforceChecksum: this.config.enforceChecksum !== false,
             versionRangeRules: this._parseVersionRangeRules(this.config.versionRangeRules || [])
         };
+        this.blockedPatternRegexes = this.securityRules.blockedPatterns.flatMap(pattern => {
+            try {
+                return [new RegExp(pattern)];
+            }
+            catch (error) {
+                this.logger.warn(`Invalid blocked pattern "${pattern}", skipping: ${error.message}`);
+                return [];
+            }
+        });
         this._logInitialization();
     }
     _parseVersionRangeRules(rules) {
@@ -89,9 +97,8 @@ class SecurityFilterPlugin {
                 this.logger.warn(`Invalid version range rule at index ${index}, skipping`);
                 return null;
             }
-            if (rule.strategy === 'fallback' && !rule.fallbackVersion) {
-                this.logger.warn(`Fallback strategy requires fallbackVersion for ${rule.package}, skipping`);
-                return null;
+            if (rule.strategy === 'fallback') {
+                this.logger.warn(`Strategy "fallback" for ${rule.package} is deprecated and works like "block": matching versions are hidden, so npm resolves to the highest allowed one`);
             }
             try {
                 const validRange = semver.validRange(rule.range);
@@ -156,10 +163,7 @@ class SecurityFilterPlugin {
         return features;
     }
     _isBlockedByPattern(packageName) {
-        return this.securityRules.blockedPatterns.some(pattern => {
-            const regex = new RegExp(pattern);
-            return regex.test(packageName);
-        });
+        return this.blockedPatternRegexes.some(regex => regex.test(packageName));
     }
     _isScopeAllowed(packageName) {
         if (!packageName.startsWith('@')) {
@@ -212,9 +216,11 @@ class SecurityFilterPlugin {
                 const tarballFile = urlMatch[3];
                 let version;
                 if (tarballFile) {
-                    const versionMatch = tarballFile.match(/-([\d.]+(?:-[a-zA-Z0-9.]+)?)\.tgz$/);
-                    version = versionMatch ? versionMatch[1] : undefined;
-                    this.logger.info(`[Middleware] TARBALL REQUEST: ${packageName}@${version || 'unknown'}`);
+                    const filePrefix = `${urlMatch[2]}-`;
+                    version = tarballFile.startsWith(filePrefix)
+                        ? tarballFile.slice(filePrefix.length, -'.tgz'.length)
+                        : undefined;
+                    this.logger.debug(`[Middleware] TARBALL REQUEST: ${packageName}@${version || 'unknown'}`);
                     const blockResult = yield this._checkPackageBlock(packageName, version);
                     if (blockResult.blocked) {
                         this.logger.warn(`[Middleware] [X] BLOCKED TARBALL: ${packageName}@${version || '*'} - ${blockResult.reason}`);
@@ -228,10 +234,10 @@ class SecurityFilterPlugin {
                         });
                         return;
                     }
-                    this.logger.info(`[Middleware] [OK] ALLOWED TARBALL: ${packageName}@${version || 'unknown'}`);
+                    this.logger.debug(`[Middleware] [OK] ALLOWED TARBALL: ${packageName}@${version || 'unknown'}`);
                 }
                 else {
-                    this.logger.info(`[Middleware] METADATA REQUEST: ${packageName} - will intercept response`);
+                    this.logger.debug(`[Middleware] METADATA REQUEST: ${packageName} - will intercept response`);
                     const blockResult = yield this._checkPackageBlock(packageName);
                     if (blockResult.blocked) {
                         this.logger.warn(`[Middleware] [X] BLOCKED METADATA: ${packageName} - ${blockResult.reason}`);
@@ -244,7 +250,7 @@ class SecurityFilterPlugin {
                                 reason: blockResult.reason,
                                 plugin: {
                                     name: 'verdaccio-security-filter',
-                                    version: '1.0.0',
+                                    version: PLUGIN_VERSION,
                                     mode: this.config.mode || 'blacklist',
                                 },
                                 blockedAt: new Date().toISOString(),
@@ -263,7 +269,7 @@ class SecurityFilterPlugin {
                         return;
                     }
                     else {
-                        this.logger.info(`[Middleware] [OK] ALLOWED METADATA: ${packageName}`);
+                        this.logger.debug(`[Middleware] [OK] ALLOWED METADATA: ${packageName}`);
                     }
                 }
                 next();
@@ -275,28 +281,52 @@ class SecurityFilterPlugin {
         }));
         this.logger.info('[Middleware] Security filter middleware registered successfully');
     }
+    _blockedPackage(pkg, reason, extra = {}) {
+        return Object.assign(Object.assign({}, pkg), { versions: {}, 'dist-tags': {}, security: Object.assign(Object.assign({ blocked: true, reason }, extra), { plugin: {
+                    name: 'verdaccio-security-filter',
+                    version: PLUGIN_VERSION,
+                    mode: this.config.mode || 'blacklist',
+                }, blockedAt: new Date().toISOString() }) });
+    }
+    _removeVersions(pkg, removed) {
+        if (removed.length === 0) {
+            return pkg;
+        }
+        const gone = new Set(removed);
+        const versions = Object.assign({}, pkg.versions);
+        for (const version of gone) {
+            delete versions[version];
+        }
+        const distTags = Object.assign({}, pkg['dist-tags']);
+        for (const [tag, tagVersion] of Object.entries(distTags)) {
+            if (gone.has(tagVersion)) {
+                delete distTags[tag];
+                this.logger.debug(`[filter_metadata] Removed dist-tag "${tag}" pointing to filtered version ${tagVersion}`);
+            }
+        }
+        return Object.assign(Object.assign({}, pkg), { versions, 'dist-tags': distTags });
+    }
     filter_metadata(packageInfo) {
         return __awaiter(this, void 0, void 0, function* () {
             var _a, _b, _c, _d, _e, _f, _g, _h, _j;
             let pkg = packageInfo;
             const packageName = pkg.name;
-            this.logger.info(`[filter_metadata] --> Processing: ${packageName}`);
+            this.logger.debug(`[filter_metadata] --> Processing: ${packageName}`);
             try {
                 const blockResult = yield this._checkPackageBlock(packageName);
                 if (blockResult.blocked) {
                     this.logger.warn(`[filter_metadata] BLOCKED: ${packageName}@* - ${blockResult.reason}`);
                     this.metrics.recordBlock(packageName, '*', blockResult.reason);
-                    return Object.assign(Object.assign({}, pkg), { versions: {}, 'dist-tags': {}, security: {
-                            blocked: true,
-                            reason: blockResult.reason,
-                            plugin: {
-                                name: 'verdaccio-security-filter',
-                                version: '2.0.0',
-                                mode: this.config.mode || 'blacklist',
-                            },
-                            blockedAt: new Date().toISOString(),
-                            rules: this._getAppliedRules(packageName),
-                        } });
+                    return this._blockedPackage(pkg, blockResult.reason, { rules: this._getAppliedRules(packageName) });
+                }
+                const whitelistMode = this.config.mode === 'whitelist';
+                if (whitelistMode || this.securityRules.blockedVersions.length > 0 || this.securityRules.versionRangeRules.length > 0) {
+                    const ruleBlocked = Object.keys(pkg.versions || {}).filter(version => this._versionBlockReason(packageName, version) !== null ||
+                        (whitelistMode && !this.whitelistChecker.isWhitelisted(packageName, version).allowed));
+                    if (ruleBlocked.length > 0) {
+                        this.logger.warn(`[filter_metadata] RULE FILTERED: ${packageName}: ${ruleBlocked.join(', ')}`);
+                        pkg = this._removeVersions(pkg, ruleBlocked);
+                    }
                 }
                 if ((_a = this.config.cveCheck) === null || _a === void 0 ? void 0 : _a.enabled) {
                     const versions = Object.keys(pkg.versions || {});
@@ -310,15 +340,7 @@ class SecurityFilterPlugin {
                         if (((_b = this.config.errorHandling) === null || _b === void 0 ? void 0 : _b.onCveCheckError) === 'fail-closed') {
                             const reason = `CVE check failed (fail-closed mode): ${error.message}`;
                             this.metrics.recordBlock(packageName, '*', reason);
-                            return Object.assign(Object.assign({}, pkg), { versions: {}, 'dist-tags': {}, security: {
-                                    blocked: true,
-                                    reason,
-                                    plugin: {
-                                        name: 'verdaccio-security-filter',
-                                        version: '2.0.0',
-                                    },
-                                    blockedAt: new Date().toISOString(),
-                                } });
+                            return this._blockedPackage(pkg, reason);
                         }
                     }
                     if (vulnerableVersions.length > 0 && !this.config.cveCheck.autoBlock) {
@@ -329,31 +351,13 @@ class SecurityFilterPlugin {
                         if (vulnerableVersions.length === versions.length) {
                             this.logger.warn(`[filter_metadata] CVE BLOCKED: ${packageName} - ${reason}`);
                             this.metrics.recordBlock(packageName, '*', reason);
-                            return Object.assign(Object.assign({}, pkg), { versions: {}, 'dist-tags': {}, security: {
-                                    blocked: true,
-                                    reason,
-                                    vulnerableVersions,
-                                    plugin: {
-                                        name: 'verdaccio-security-filter',
-                                        version: '2.0.0',
-                                    },
-                                    blockedAt: new Date().toISOString(),
-                                } });
+                            return this._blockedPackage(pkg, reason, { vulnerableVersions });
                         }
                         this.logger.warn(`[filter_metadata] CVE FILTERED: ${packageName} - ${reason}: ${vulnerableVersions.join(', ')}`);
-                        const filteredVersions = Object.assign({}, pkg.versions);
                         for (const version of vulnerableVersions) {
-                            delete filteredVersions[version];
                             this.metrics.recordBlock(packageName, version, reason);
                         }
-                        const filteredDistTags = Object.assign({}, pkg['dist-tags']);
-                        for (const [tag, tagVersion] of Object.entries(filteredDistTags)) {
-                            if (vulnerableVersions.includes(tagVersion)) {
-                                delete filteredDistTags[tag];
-                                this.logger.debug(`[filter_metadata] Removed dist-tag "${tag}" pointing to vulnerable version ${tagVersion}`);
-                            }
-                        }
-                        pkg = Object.assign(Object.assign({}, pkg), { versions: filteredVersions, 'dist-tags': filteredDistTags });
+                        pkg = this._removeVersions(pkg, vulnerableVersions);
                     }
                 }
                 if (this.config.licenses && this.config.licenses.allowed && this.config.licenses.allowed.length > 0) {
@@ -362,66 +366,38 @@ class SecurityFilterPlugin {
                         const versionData = pkg.versions[latestVersion];
                         const licenseResult = this.licenseChecker.checkLicense(versionData);
                         if (!licenseResult.allowed) {
-                            this.logger.warn(`[filter_metadata] LICENSE BLOCKED: ${packageName} - ${licenseResult.reason}`);
-                            this.metrics.recordBlock(packageName, '*', licenseResult.reason || 'License not allowed');
-                            return Object.assign(Object.assign({}, pkg), { versions: {}, 'dist-tags': {}, security: {
-                                    blocked: true,
-                                    reason: licenseResult.reason || 'License not allowed',
-                                    license: licenseResult.license,
-                                    plugin: {
-                                        name: 'verdaccio-security-filter',
-                                        version: '2.0.0',
-                                    },
-                                    blockedAt: new Date().toISOString(),
-                                } });
+                            const reason = licenseResult.reason || 'License not allowed';
+                            this.logger.warn(`[filter_metadata] LICENSE BLOCKED: ${packageName} - ${reason}`);
+                            this.metrics.recordBlock(packageName, '*', reason);
+                            return this._blockedPackage(pkg, reason, { license: licenseResult.license });
                         }
                     }
                 }
                 if ((_e = this.config.packageAge) === null || _e === void 0 ? void 0 : _e.enabled) {
                     const ageResult = this.packageAgeChecker.checkPackageAge(pkg);
                     if (!ageResult.allowed && !ageResult.warnOnly) {
-                        this.logger.warn(`[filter_metadata] AGE BLOCKED: ${packageName} - ${ageResult.reason}`);
-                        this.metrics.recordBlock(packageName, '*', ageResult.reason || 'Package too new');
-                        return Object.assign(Object.assign({}, pkg), { versions: {}, 'dist-tags': {}, security: {
-                                blocked: true,
-                                reason: ageResult.reason || 'Package too new',
-                                ageDays: ageResult.ageDays,
-                                plugin: {
-                                    name: 'verdaccio-security-filter',
-                                    version: '2.0.0',
-                                },
-                                blockedAt: new Date().toISOString(),
-                            } });
+                        const reason = ageResult.reason || 'Package too new';
+                        this.logger.warn(`[filter_metadata] AGE BLOCKED: ${packageName} - ${reason}`);
+                        this.metrics.recordBlock(packageName, '*', reason);
+                        return this._blockedPackage(pkg, reason, { ageDays: ageResult.ageDays });
                     }
                     else if (!ageResult.allowed && ageResult.warnOnly) {
                         this.logger.warn(`[filter_metadata] AGE WARNING: ${packageName} - ${ageResult.reason} (warn-only mode)`);
                     }
                     if (this.config.packageAge.minVersionAgeDays) {
-                        const filteredVersions = Object.assign({}, pkg.versions);
                         const removedVersions = [];
-                        for (const version of Object.keys(filteredVersions)) {
+                        for (const version of Object.keys(pkg.versions || {})) {
                             const versionAgeResult = this.packageAgeChecker.checkVersionAge(pkg, version);
                             if (!versionAgeResult.allowed && !versionAgeResult.warnOnly) {
                                 this.logger.warn(`[filter_metadata] VERSION AGE FILTERED: ${packageName}@${version} - ${versionAgeResult.reason}`);
                                 this.metrics.recordBlock(packageName, version, versionAgeResult.reason || 'Version too new');
-                                delete filteredVersions[version];
                                 removedVersions.push(version);
                             }
                             else if (!versionAgeResult.allowed && versionAgeResult.warnOnly) {
                                 this.logger.warn(`[filter_metadata] VERSION AGE WARNING: ${packageName}@${version} - ${versionAgeResult.reason} (warn-only mode)`);
                             }
                         }
-                        if (removedVersions.length > 0) {
-                            this.logger.info(`[filter_metadata] Removed ${removedVersions.length} too-new version(s) from ${packageName}: ${removedVersions.join(', ')}`);
-                            const filteredDistTags = Object.assign({}, pkg['dist-tags']);
-                            for (const [tag, tagVersion] of Object.entries(filteredDistTags)) {
-                                if (removedVersions.includes(tagVersion)) {
-                                    delete filteredDistTags[tag];
-                                    this.logger.debug(`[filter_metadata] Removed dist-tag "${tag}" pointing to filtered version ${tagVersion}`);
-                                }
-                            }
-                            pkg = Object.assign(Object.assign({}, pkg), { versions: filteredVersions, 'dist-tags': filteredDistTags });
-                        }
+                        pkg = this._removeVersions(pkg, removedVersions);
                     }
                 }
                 if ((_f = this.config.authorFilter) === null || _f === void 0 ? void 0 : _f.enabled) {
@@ -430,36 +406,30 @@ class SecurityFilterPlugin {
                         const versionData = pkg.versions[latestVersion];
                         const authorResult = this.authorChecker.checkAuthor(versionData);
                         if (!authorResult.allowed && !this.config.authorFilter.warnOnly) {
-                            this.logger.warn(`[filter_metadata] AUTHOR BLOCKED: ${packageName} - ${authorResult.reason}`);
+                            const reason = authorResult.reason || 'Author not allowed';
+                            this.logger.warn(`[filter_metadata] AUTHOR BLOCKED: ${packageName} - ${reason}`);
                             this.metrics.record({
                                 timestamp: new Date().toISOString(),
                                 event: 'author_blocked',
                                 packageName,
                                 version: latestVersion,
-                                reason: authorResult.reason || 'Author not allowed',
+                                reason,
                                 metadata: {
                                     blockedBy: authorResult.blockedBy,
                                     authorInfo: authorResult.authorInfo,
                                 },
                             });
-                            return Object.assign(Object.assign({}, pkg), { versions: {}, 'dist-tags': {}, security: {
-                                    blocked: true,
-                                    reason: authorResult.reason || 'Author not allowed',
-                                    blockedBy: authorResult.blockedBy,
-                                    authorInfo: authorResult.authorInfo,
-                                    plugin: {
-                                        name: 'verdaccio-security-filter',
-                                        version: '2.0.0',
-                                    },
-                                    blockedAt: new Date().toISOString(),
-                                } });
+                            return this._blockedPackage(pkg, reason, {
+                                blockedBy: authorResult.blockedBy,
+                                authorInfo: authorResult.authorInfo,
+                            });
                         }
                         else if (!authorResult.allowed && this.config.authorFilter.warnOnly) {
                             this.logger.warn(`[filter_metadata] AUTHOR WARNING: ${packageName} - ${authorResult.reason} (warn-only mode)`);
                         }
                     }
                 }
-                this.logger.info(`[filter_metadata] [OK] ALLOWED: ${packageName}`);
+                this.logger.debug(`[filter_metadata] [OK] ALLOWED: ${packageName}`);
                 return pkg;
             }
             catch (error) {
@@ -468,21 +438,20 @@ class SecurityFilterPlugin {
                 if (errorStrategy === 'fail-closed') {
                     this.logger.warn(`[filter_metadata] Error handling: fail-closed - BLOCKING ${packageName}`);
                     this.metrics.recordBlock(packageName, '*', `Error during processing: ${error.message}`);
-                    return Object.assign(Object.assign({}, packageInfo), { versions: {}, 'dist-tags': {}, security: {
-                            blocked: true,
-                            reason: `Error during security processing (fail-closed mode): ${error.message}`,
-                            plugin: {
-                                name: 'verdaccio-security-filter',
-                                version: '2.0.0',
-                            },
-                            blockedAt: new Date().toISOString(),
-                        } });
+                    return this._blockedPackage(packageInfo, `Error during security processing (fail-closed mode): ${error.message}`);
                 }
                 this.logger.warn(`[filter_metadata] Error handling: fail-open - ALLOWING ${packageName}`);
                 return packageInfo;
             }
         });
     }
+    _versionBlockReason(packageName, version) {
+        if (this.securityRules.blockedVersions.includes(`${packageName}@${version}`)) {
+            return 'Exact version match in blocklist';
+        }
+        const rangeRule = this._getVersionRangeRule(packageName, version);
+        return rangeRule ? `Version matches blocked range: ${rangeRule.range}` : null;
+    }
     _checkPackageBlock(packageName, version) {
         return __awaiter(this, void 0, void 0, function* () {
             if (this.config.mode === 'whitelist') {
@@ -497,15 +466,9 @@ class SecurityFilterPlugin {
             if (!this._isScopeAllowed(packageName)) {
                 return { blocked: true, reason: 'Package scope not allowed' };
             }
-            if (version) {
-                const versionKey = `${packageName}@${version}`;
-                if (this.securityRules.blockedVersions.includes(versionKey)) {
-                    return { blocked: true, reason: 'Exact version match in blocklist' };
-                }
-                const rangeRule = this._getVersionRangeRule(packageName, version);
-                if (rangeRule && rangeRule.strategy === 'block') {
-                    return { blocked: true, reason: `Version matches blocked range: ${rangeRule.range}` };
-                }
+            const versionReason = version ? this._versionBlockReason(packageName, version) : null;
+            if (versionReason) {
+                return { blocked: true, reason: versionReason };
             }
             return { blocked: false, reason: '' };
         });
@@ -516,11 +479,9 @@ class SecurityFilterPlugin {
             rules.mode = 'whitelist';
             rules.whitelisted = false;
         }
-        if (this._isBlockedByPattern(packageName)) {
-            rules.blockedPattern = this.securityRules.blockedPatterns.find(pattern => {
-                const regex = new RegExp(pattern);
-                return regex.test(packageName);
-            });
+        const blockedPattern = this.blockedPatternRegexes.find(regex => regex.test(packageName));
+        if (blockedPattern) {
+            rules.blockedPattern = blockedPattern.source;
         }
         if (packageName.startsWith('@')) {
             const scope = packageName.split('/')[0];

package/build/lib/metrics.d.ts

@@ -4,12 +4,12 @@ export declare class MetricsCollector {
     private metricsBuffer;
     private readonly bufferSize;
     private readonly maxBufferSize;
+    private readonly flushIntervalMs;
+    private flushTimer;
     constructor(config?: MetricsConfig);
     record(event: MetricsData): void;
     recordBlock(packageName: string, version: string, reason: string, metadata?: Record<string, any>): void;
-    recordFallback(packageName: string, fromVersion: string, toVersion: string, reason: string): void;
     recordPublishRejected(packageName: string, version: string, reason: string): void;
-    recordCVE(packageName: string, version: string, cveId: string, severity: string): void;
     recordLicenseBlock(packageName: string, version: string, license: string, reason: string): void;
     recordPackageTooNew(packageName: string, version: string, reason: string, metadata?: Record<string, any>): void;
     flush(): void;

package/build/lib/metrics.js

@@ -41,11 +41,17 @@ class MetricsCollector {
         this.metricsBuffer = [];
         this.bufferSize = 100;
         this.maxBufferSize = 500;
+        this.flushIntervalMs = 10000;
+        this.flushTimer = null;
         this.config = {
             enabled: (config === null || config === void 0 ? void 0 : config.enabled) || false,
             output: (config === null || config === void 0 ? void 0 : config.output) || 'stdout',
             filePath: (config === null || config === void 0 ? void 0 : config.filePath) || './security-metrics.json',
         };
+        if (this.config.enabled) {
+            this.flushTimer = setInterval(() => this.flush(), this.flushIntervalMs);
+            this.flushTimer.unref();
+        }
     }
     record(event) {
         if (!this.config.enabled) {
@@ -69,16 +75,6 @@ class MetricsCollector {
             metadata,
         });
     }
-    recordFallback(packageName, fromVersion, toVersion, reason) {
-        this.record({
-            timestamp: new Date().toISOString(),
-            event: 'fallback',
-            packageName,
-            version: fromVersion,
-            reason,
-            metadata: { toVersion },
-        });
-    }
     recordPublishRejected(packageName, version, reason) {
         this.record({
             timestamp: new Date().toISOString(),
@@ -88,16 +84,6 @@ class MetricsCollector {
             reason,
         });
     }
-    recordCVE(packageName, version, cveId, severity) {
-        this.record({
-            timestamp: new Date().toISOString(),
-            event: 'cve_detected',
-            packageName,
-            version,
-            reason: `CVE ${cveId} (${severity})`,
-            metadata: { cveId, severity },
-        });
-    }
     recordLicenseBlock(packageName, version, license, reason) {
         this.record({
             timestamp: new Date().toISOString(),
@@ -163,6 +149,10 @@ class MetricsCollector {
         return summary;
     }
     cleanup() {
+        if (this.flushTimer) {
+            clearInterval(this.flushTimer);
+            this.flushTimer = null;
+        }
         this.flush();
     }
 }

package/build/lib/whitelist-checker.d.ts

@@ -1,22 +1,19 @@
 import { WhitelistConfig } from '../types';
 export declare class WhitelistChecker {
     private config;
+    private regexes;
     constructor(config?: WhitelistConfig);
     isWhitelisted(packageName: string, version?: string): {
         allowed: boolean;
         reason?: string;
     };
     private matchesPattern;
+    private compile;
     addPackage(packageName: string, versionRange?: string): void;
     removePackage(packageName: string): void;
     addPattern(pattern: string): void;
-    meetsAutoApproveCriteria(_packageName: string): Promise<{
-        approved: boolean;
-        reason?: string;
-    }>;
     getSummary(): {
         totalPackages: number;
         totalPatterns: number;
-        hasAutoApprove: boolean;
     };
 }

package/build/lib/whitelist-checker.js

@@ -32,25 +32,16 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.WhitelistChecker = void 0;
 const semver = __importStar(require("semver"));
 class WhitelistChecker {
     constructor(config) {
+        this.regexes = new Map();
         this.config = {
             packages: (config === null || config === void 0 ? void 0 : config.packages) || [],
             patterns: (config === null || config === void 0 ? void 0 : config.patterns) || [],
             versions: (config === null || config === void 0 ? void 0 : config.versions) || {},
-            autoApprove: config === null || config === void 0 ? void 0 : config.autoApprove,
         };
     }
     isWhitelisted(packageName, version) {
@@ -75,16 +66,21 @@ class WhitelistChecker {
         };
     }
     matchesPattern(packageName) {
-        return this.config.patterns.some(pattern => {
+        return this.config.patterns.some(pattern => { var _a; return (_a = this.compile(pattern)) === null || _a === void 0 ? void 0 : _a.test(packageName); });
+    }
+    compile(pattern) {
+        let regex = this.regexes.get(pattern);
+        if (regex === undefined) {
             try {
-                const regex = new RegExp(pattern);
-                return regex.test(packageName);
+                regex = new RegExp(pattern);
             }
             catch (_a) {
                 console.error(`[Whitelist] Invalid pattern: ${pattern}`);
-                return false;
+                regex = null;
             }
-        });
+            this.regexes.set(pattern, regex);
+        }
+        return regex;
     }
     addPackage(packageName, versionRange) {
         if (!this.config.packages.includes(packageName)) {
@@ -109,22 +105,10 @@ class WhitelistChecker {
             this.config.patterns.push(pattern);
         }
     }
-    meetsAutoApproveCriteria(_packageName) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (!this.config.autoApprove) {
-                return { approved: false, reason: 'Auto-approve not configured' };
-            }
-            return {
-                approved: false,
-                reason: 'Auto-approve requires npm registry API integration (not implemented)',
-            };
-        });
-    }
     getSummary() {
         return {
             totalPackages: this.config.packages.length,
             totalPatterns: this.config.patterns.length,
-            hasAutoApprove: !!this.config.autoApprove,
         };
     }
 }

package/build/types.d.ts

@@ -1,4 +1,4 @@
-import { Config, Version } from '@verdaccio/types';
+import { Config } from '@verdaccio/types';
 export interface VersionRangeRule {
     package: string;
     range: string;
@@ -8,7 +8,7 @@ export interface VersionRangeRule {
 }
 export interface CVECheckConfig {
     enabled: boolean;
-    databases: ('osv' | 'snyk' | 'github')[];
+    databases: 'osv'[];
     severity: ('low' | 'medium' | 'high' | 'critical')[];
     autoBlock: boolean;
     updateInterval?: number;
@@ -18,11 +18,6 @@ export interface WhitelistConfig {
     packages: string[];
     patterns: string[];
     versions?: Record<string, string>;
-    autoApprove?: {
-        minDownloads?: number;
-        minStars?: number;
-        verifiedPublisher?: boolean;
-    };
 }
 export interface LicenseConfig {
     allowed: string[];
@@ -59,11 +54,8 @@ export interface AuthorFilterConfig {
 export interface SecurityConfig extends Config {
     blockedVersions?: string[];
     blockedPatterns?: string[];
-    minPackageSize?: number;
-    maxPackageSize?: number;
     allowedScopes?: string[];
     blockedScopes?: string[];
-    enforceChecksum?: boolean;
     versionRangeRules?: VersionRangeRule[];
     mode?: 'blacklist' | 'whitelist';
     whitelist?: WhitelistConfig;
@@ -76,32 +68,15 @@ export interface SecurityConfig extends Config {
     errorHandling?: {
         onFilterError?: 'fail-open' | 'fail-closed';
         onCveCheckError?: 'fail-open' | 'fail-closed';
-        onLicenseCheckError?: 'fail-open' | 'fail-closed';
     };
 }
 export interface SecurityRules {
     blockedVersions: string[];
     blockedPatterns: string[];
-    minPackageSize: number;
-    maxPackageSize: number;
     allowedScopes: string[];
     blockedScopes: string[];
-    enforceChecksum: boolean;
     versionRangeRules: VersionRangeRule[];
 }
-export interface VersionData extends Version {
-    _fallback?: boolean;
-    _fallbackFrom?: string;
-    _fallbackReason?: string;
-}
-export interface FilterResult {
-    versions: Record<string, VersionData>;
-    blockedVersions: string[];
-    fallbacksApplied: Array<{
-        original: string;
-        fallback: string;
-    }>;
-}
 export interface CVEVulnerability {
     id: string;
     severity: 'low' | 'medium' | 'high' | 'critical';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "verdaccio-security-filter",
-  "version": "1.3.9",
+  "version": "1.3.11",
   "description": "Advanced security filter plugin for Verdaccio with version range blocking and fallback strategies",
   "main": "build/index.js",
   "types": "build/index.d.ts",
@@ -28,6 +28,7 @@
     "test": "jest",
     "test:watch": "jest --watch",
     "test:coverage": "jest --coverage",
+    "test:e2e": "npm run build && jest --testMatch \"**/*.e2e.ts\" --coverage=false",
     "debug:verdaccio": "node --inspect-brk $(which verdaccio)",
     "debug:build": "npm run build && npm link",
     "prepack": "npm run build",
@@ -55,7 +56,7 @@
   },
   "overrides": {
     "qs": "6.16.0",
-    "@cypress/request": "latest"
+    "@cypress/request": "3.0.10"
   },
   "author": {
     "name": "Vitaliy Ponomarenko",