worm-sign/dist/src/package-managers/npm.js

A prescient scanner to detect and banish Shai Hulud malware from your dependencies.

"use strict";
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    var desc = Object.getOwnPropertyDescriptor(m, k);
    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
      desc = { enumerable: true, get: function() { return m[k]; } };
    }
    Object.defineProperty(o, k2, desc);
}) : (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
    Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
    o["default"] = v;
});
var __importStar = (this && this.__importStar) || (function () {
    var ownKeys = function(o) {
        ownKeys = Object.getOwnPropertyNames || function (o) {
            var ar = [];
            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
            return ar;
        };
        return ownKeys(o);
    };
    return function (mod) {
        if (mod && mod.__esModule) return mod;
        var result = {};
        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
        __setModuleDefault(result, mod);
        return result;
    };
})();
Object.defineProperty(exports, "__esModule", { value: true });
const fs = __importStar(require("fs"));
const path = __importStar(require("path"));
function collectFromLock(lockJson) {
    const packages = new Map();
    const integrity = new Map();
    if (lockJson.packages) {
        for (const [pkgPath, info] of Object.entries(lockJson.packages)) {
            if (!info)
                continue;
            const name = info.name || inferNameFromPath(pkgPath);
            if (!name)
                continue;
            const set = packages.get(name) ?? new Set();
            const ver = info.version || info.resolved || 'unknown';
            set.add(ver);
            packages.set(name, set);
            if (info.integrity) {
                const pkgIntegrity = integrity.get(name) ?? new Map();
                pkgIntegrity.set(ver, info.integrity);
                integrity.set(name, pkgIntegrity);
            }
        }
    }
    if (lockJson.dependencies) {
        traverseDeps(lockJson.dependencies, packages, integrity);
    }
    return { packages, integrity };
}
function traverseDeps(deps, packages, integrity) {
    if (!deps)
        return;
    for (const [name, info] of Object.entries(deps)) {
        const set = packages.get(name) ?? new Set();
        const ver = info?.version || 'unknown';
        set.add(ver);
        packages.set(name, set);
        if (info?.integrity) {
            const pkgIntegrity = integrity.get(name) ?? new Map();
            pkgIntegrity.set(ver, info.integrity);
            integrity.set(name, pkgIntegrity);
        }
        if (info?.dependencies) {
            traverseDeps(info.dependencies, packages, integrity);
        }
        if (info?.requires) {
            traverseDeps(info.requires, packages, integrity);
        }
    }
}
function inferNameFromPath(pkgPath) {
    if (!pkgPath || pkgPath === '')
        return null;
    const segments = pkgPath.split('node_modules/').filter(Boolean);
    if (segments.length === 0)
        return null;
    const lastSegment = segments[segments.length - 1];
    if (lastSegment.startsWith('@')) {
        const scoped = segments.slice(-2).join('/');
        return scoped || lastSegment;
    }
    return lastSegment;
}
function detectFromPackageManagerField(fieldValue) {
    if (!fieldValue)
        return false;
    return fieldValue.startsWith('npm');
}
function findLockFile(repoRoot, lockFiles) {
    for (const fileName of lockFiles) {
        const fullPath = path.join(repoRoot, fileName);
        if (fs.existsSync(fullPath)) {
            return fullPath;
        }
    }
    return null;
}
function loadLockPackages(lockPath) {
    const warnings = [];
    const packages = new Map();
    if (!fs.existsSync(lockPath)) {
        warnings.push(`Lockfile not found at ${lockPath}`);
        return { packages, warnings, success: false };
    }
    try {
        const lockJson = JSON.parse(fs.readFileSync(lockPath, 'utf8'));
        const result = collectFromLock(lockJson);
        return {
            packages: result.packages,
            packageIntegrity: result.integrity,
            warnings,
            success: true,
        };
    }
    catch (err) {
        const msg = err instanceof Error ? err.message : String(err);
        warnings.push(`Unable to parse ${path.basename(lockPath)}: ${msg}`);
        return { packages, warnings, success: false };
    }
}
const npmHandler = {
    id: 'npm',
    label: 'npm',
    lockFiles: ['package-lock.json', 'npm-shrinkwrap.json'],
    detectFromPackageManagerField,
    findLockFile: (repoRoot) => findLockFile(repoRoot, ['package-lock.json', 'npm-shrinkwrap.json']),
    loadLockPackages,
};
exports.default = npmHandler;