@dreamhorizonorg/sentinel/lib/providers/index.mjs

Open-source, zero-dependency tool that blocks compromised packages BEFORE download. Built to counter supply chain and credential theft attacks like Shai-Hulud.

/**
 * Vulnerability Providers
 * Central registry and manager for all vulnerability providers
 */

import { OSVProvider } from './osv.provider.mjs';
import { GitHubAdvisoriesProvider } from './github-advisories.provider.mjs';
import { SnykProvider } from './snyk.provider.mjs';

/**
 * All available providers
 */
export const PROVIDERS = {
  OSV: OSVProvider,
  GITHUB: GitHubAdvisoriesProvider,
  SNYK: SnykProvider
};

/**
 * Get enabled providers from config
 */
export function getEnabledProviders(config = {}) {
  const providers = [];
  const providersConfig = config.providers ?? {};

  // OSV (enabled by default)
  if (providersConfig.osv?.enabled !== false) {
    providers.push(new OSVProvider());
  }

  // GitHub Advisories (enabled by default)
  if (providersConfig.github?.enabled !== false) {
    providers.push(new GitHubAdvisoriesProvider());
  }

  // Snyk (disabled by default, requires token)
  if (providersConfig.snyk?.enabled === true) {
    providers.push(new SnykProvider());
  }

  return providers;
}

/**
 * Check package against all enabled providers
 * Returns first vulnerability found (most severe)
 */
export async function checkWithProviders(packageName, version = null, config = {}) {
  const providers = getEnabledProviders(config);
  const providersConfig = config.providers ?? {};

  if (providers.length === 0) {
    return { found: false };
  }

  // Check all providers in parallel
  const results = await Promise.allSettled(
    providers.map(provider => {
      // Map provider name to config key
      let configKey = provider.name.toLowerCase().replace(/\s+/g, '');
      if (configKey === 'githubadvisories') {
        configKey = 'github';
      }
      const providerConfig = providersConfig[configKey] ?? {};
      return provider.check(packageName, version, { ...config, ...providerConfig });
    })
  );

  // Find first vulnerability (providers are ordered by priority)
  for (const result of results) {
    if (result.status === 'fulfilled' && result.value.found) {
      return result.value;
    }
  }

  return { found: false };
}