@dreamhorizonorg/sentinel/lib/providers/provider.interface.mjs

Open-source, zero-dependency tool that blocks compromised packages BEFORE download. Built to counter supply chain and credential theft attacks like Shai-Hulud.

/**
 * Provider Interface
 * All vulnerability providers must implement this interface
 */

/**
 * Vulnerability result from a provider
 * @typedef {Object} VulnerabilityResult
 * @property {boolean} found - Whether a vulnerability was found
 * @property {string} [severity] - Severity level (low, medium, high, critical)
 * @property {string} [title] - Vulnerability title/description
 * @property {string} [source] - Provider name
 * @property {string} [cve] - CVE identifier if available
 * @property {string} [url] - Link to vulnerability details
 */

/**
 * Provider interface
 * All providers must implement these methods
 */
export class VulnerabilityProvider {
  /**
   * Provider name
   * @type {string}
   */
  name = '';

  /**
   * Check if a package has vulnerabilities
   * @param {string} packageName - Package name
   * @param {string|null} version - Package version (optional)
   * @param {Object} config - Provider-specific configuration
   * @returns {Promise<VulnerabilityResult>}
   */
  async check(packageName, version = null, config = {}) {
    throw new Error('check() method must be implemented');
  }

  /**
   * Check if provider is enabled
   * @param {Object} config - Provider-specific configuration
   * @returns {boolean}
   */
  isEnabled(config = {}) {
    return config.enabled !== false;
  }

  /**
   * Get provider configuration defaults
   * @returns {Object}
   */
  getDefaultConfig() {
    return {
      enabled: true,
      timeout: 5000
    };
  }
}