From 04e90f9333db52a7acc0e60d606cb651ea46a14c Mon Sep 17 00:00:00 2001 From: VitoAlbano Date: Fri, 29 May 2026 11:20:55 +0100 Subject: [PATCH] [AAE-46514] - using by default ignore-scripts and have a trusted list for those who are trusted --- README.md | 14 + package-lock.json | 390 ++++++++++++++++---------- package.json | 92 +++--- scripts/check-security.mjs | 461 +++++++++++++++++++++++++++++++ scripts/postinstall-security.mjs | 160 +++++++++++ 5 files changed, 929 insertions(+), 188 deletions(-) create mode 100644 scripts/check-security.mjs create mode 100644 scripts/postinstall-security.mjs diff --git a/README.md b/README.md index f9ad6c21f3..d0af2f6fd5 100644 --- a/README.md +++ b/README.md @@ -21,6 +21,20 @@ for full details on what you may need to install before using ADF. - [Node Version Manager](docs/tutorials/nvm.md) - [CORS guide](ALFRESCOCORS.md) +## Installation + +```bash +npm install # or npm ci +``` + +This project has built-in supply chain attack protection. When you run `npm install`: + +1. All packages install with scripts disabled (via `.npmrc`) +2. Security check runs against OSV + GitHub Advisory databases (109+ known threats) +3. Only trusted packages (esbuild, nx, husky, etc.) get their scripts executed + +If a malicious package is detected, installation is blocked and `node_modules` is deleted. + ## Components You can find the sources for all ADF components in the [`lib`](/lib) folder. diff --git a/package-lock.json b/package-lock.json index 8d9b676d15..0bfa9868ac 100644 --- a/package-lock.json +++ b/package-lock.json @@ -23,20 +23,20 @@ "@apollo/client": "3.13.1", "@cspell/eslint-plugin": "10.0.0", "@mat-datetimepicker/core": "15.0.2", - "@ngx-translate/core": "^17.0.0", + "@ngx-translate/core": "17.0.0", "angular-oauth2-oidc": "19.0.0", "apollo-angular": "10.0.3", "chart.js": "4.4.4", "cropperjs": "1.6.2", - "date-fns": "^2.30.0", - "dotenv-expand": "^5.1.0", - "editorjs-html": "^4.0.5", - "eventemitter3": "^5.0.1", - "graphql-ws": "^6.0.5", - "material-icons": "^1.13.12", + "date-fns": "2.30.0", + "dotenv-expand": "5.1.0", + "editorjs-html": "4.0.5", + "eventemitter3": "5.0.4", + "graphql-ws": "6.0.8", + "material-icons": "1.13.14", "minimatch-browser": "1.0.0", - "ng2-charts": "^4.1.1", - "node-fetch": "^3.3.2", + "ng2-charts": "4.1.1", + "node-fetch": "3.3.2", "pdfjs-dist": "5.1.91", "raphael": "2.3.0", "rxjs": "7.8.2", @@ -61,60 +61,60 @@ "@nx/storybook": "22.7.4", "@nx/workspace": "22.7.4", "@schematics/angular": "19.2.22", - "@storybook/addon-themes": "^10.2.0", - "@storybook/angular": "^10.2.0", - "@types/ejs": "^3.1.5", + "@storybook/addon-themes": "10.2.0", + "@storybook/angular": "10.2.0", + "@types/ejs": "3.1.5", "@types/jasmine": "4.0.3", - "@types/jasminewd2": "~2.0.2", - "@types/jest": "^29.5.14", - "@types/jsdom": "^27.0.0", + "@types/jasminewd2": "2.0.13", + "@types/jest": "29.5.14", + "@types/jsdom": "27.0.0", "@types/minimatch": "5.1.2", "@types/node": "25.9.1", - "@typescript-eslint/eslint-plugin": "8.60.0", - "@typescript-eslint/parser": "8.60.0", - "@typescript-eslint/typescript-estree": "8.60.0", - "@typescript-eslint/utils": "^8.51.0", - "ajv": "^8.18.0", + "@typescript-eslint/eslint-plugin": "8.59.4", + "@typescript-eslint/parser": "8.59.4", + "@typescript-eslint/typescript-estree": "8.59.4", + "@typescript-eslint/utils": "8.59.4", + "ajv": "8.20.0", "dotenv": "16.4.7", - "ejs": "^3.1.10", - "eslint": "^8.47.0", + "ejs": "3.1.10", + "eslint": "8.57.1", "eslint-config-prettier": "10.1.8", - "eslint-plugin-ban": "^1.6.0", + "eslint-plugin-ban": "1.6.0", "eslint-plugin-import": "2.32.0", "eslint-plugin-jsdoc": "50.3.1", "eslint-plugin-license-header": "0.8.0", - "eslint-plugin-prettier": "^5.5.4", - "eslint-plugin-rxjs": "^5.0.3", - "eslint-plugin-storybook": "^10.2.0", - "eslint-plugin-unicorn": "^49.0.0", - "graphql": "^16.14.0", - "husky": "^9.1.7", + "eslint-plugin-prettier": "5.5.6", + "eslint-plugin-rxjs": "5.0.3", + "eslint-plugin-storybook": "10.2.0", + "eslint-plugin-unicorn": "49.0.0", + "graphql": "16.14.0", + "husky": "9.1.7", "jasmine-core": "5.13.0", - "jasmine-reporters": "^2.5.2", - "jest": "^29.7.0", - "jest-environment-jsdom": "^29.7.0", + "jasmine-reporters": "2.5.2", + "jest": "29.7.0", + "jest-environment-jsdom": "29.7.0", "jest-preset-angular": "14.4.2", - "jsdom": "^27.4.0", + "jsdom": "27.4.0", "karma": "6.4.4", - "karma-chrome-launcher": "~3.2.0", - "karma-coverage": "~2.2.0", + "karma-chrome-launcher": "3.2.0", + "karma-coverage": "2.2.1", "karma-jasmine": "5.1.0", - "karma-jasmine-html-reporter": "^2.1.0", + "karma-jasmine-html-reporter": "2.2.0", "lint-staged": "17.0.5", "ng-packagr": "19.2.2", "nx": "22.7.4", "prettier": "3.8.3", - "react": "^19.2.6", - "react-dom": "^19.2.6", - "rimraf": "^6.1.2", + "react": "19.2.6", + "react-dom": "19.2.6", + "rimraf": "6.1.3", "sass-loader": "16.0.8", - "spdx-license-list": "^6.11.0", - "storybook": "^10.2.13", + "spdx-license-list": "6.11.0", + "storybook": "10.2.13", "stylelint": "16.20.0", - "stylelint-config-standard-scss": "^13.1.0", - "ts-node": "^10.9.2", + "stylelint-config-standard-scss": "13.1.0", + "ts-node": "10.9.2", "typescript": "5.8.3", - "undici": "^8.3.0", + "undici": "8.3.0", "webpack": "5.107.2" }, "engines": { @@ -355,6 +355,23 @@ } } }, + "node_modules/@angular-devkit/build-angular/node_modules/ajv": { + "version": "8.18.0", + "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.18.0.tgz", + "integrity": "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==", + "dev": true, + "license": "MIT", + "dependencies": { + "fast-deep-equal": "^3.1.3", + "fast-uri": "^3.0.1", + "json-schema-traverse": "^1.0.0", + "require-from-string": "^2.0.2" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/epoberezkin" + } + }, "node_modules/@angular-devkit/build-angular/node_modules/rxjs": { "version": "7.8.1", "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.8.1.tgz", @@ -470,6 +487,23 @@ } } }, + "node_modules/@angular-devkit/build-webpack/node_modules/ajv": { + "version": "8.18.0", + "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.18.0.tgz", + "integrity": "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==", + "dev": true, + "license": "MIT", + "dependencies": { + "fast-deep-equal": "^3.1.3", + "fast-uri": "^3.0.1", + "json-schema-traverse": "^1.0.0", + "require-from-string": "^2.0.2" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/epoberezkin" + } + }, "node_modules/@angular-devkit/build-webpack/node_modules/rxjs": { "version": "7.8.1", "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.8.1.tgz", @@ -508,6 +542,23 @@ } } }, + "node_modules/@angular-devkit/core/node_modules/ajv": { + "version": "8.18.0", + "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.18.0.tgz", + "integrity": "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==", + "dev": true, + "license": "MIT", + "dependencies": { + "fast-deep-equal": "^3.1.3", + "fast-uri": "^3.0.1", + "json-schema-traverse": "^1.0.0", + "require-from-string": "^2.0.2" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/epoberezkin" + } + }, "node_modules/@angular-devkit/core/node_modules/rxjs": { "version": "7.8.1", "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.8.1.tgz", @@ -766,6 +817,23 @@ } } }, + "node_modules/@angular/build/node_modules/ajv": { + "version": "8.18.0", + "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.18.0.tgz", + "integrity": "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==", + "dev": true, + "license": "MIT", + "dependencies": { + "fast-deep-equal": "^3.1.3", + "fast-uri": "^3.0.1", + "json-schema-traverse": "^1.0.0", + "require-from-string": "^2.0.2" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/epoberezkin" + } + }, "node_modules/@angular/build/node_modules/rxjs": { "version": "7.8.1", "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.8.1.tgz", @@ -10689,12 +10757,12 @@ } }, "node_modules/@pkgr/core": { - "version": "0.2.9", - "resolved": "https://registry.npmjs.org/@pkgr/core/-/core-0.2.9.tgz", - "integrity": "sha512-QNqXyfVS2wm9hweSYD2O7F0G06uurj9kZ96TRQE5Y9hU7+tgdZwIkbAKc5Ocy1HxEY2kuDQa6cQ1WRs/O5LFKA==", + "version": "0.3.6", + "resolved": "https://registry.npmjs.org/@pkgr/core/-/core-0.3.6.tgz", + "integrity": "sha512-SEeaJLb3qBNF/OaXnaR1NmmBbFYk1zC0ZH/52fATcRPLFg/p791YrcyFFy44Bo9sLaGuSuLp5Q6axbb/O+v/RA==", "license": "MIT", "engines": { - "node": "^12.20.0 || ^14.18.0 || >=16.0.0" + "node": "^14.18.0 || >=16.0.0" }, "funding": { "url": "https://opencollective.com/pkgr" @@ -11590,9 +11658,9 @@ "license": "MIT" }, "node_modules/@storybook/addon-themes": { - "version": "10.3.0", - "resolved": "https://registry.npmjs.org/@storybook/addon-themes/-/addon-themes-10.3.0.tgz", - "integrity": "sha512-tMNRnEXv91u2lYgyUUAPhWiPD2XTLw2prj6r9/e9wmKYqJ5a2q0gQ7MiGzbgNYWmqq+DZ7g4vvGt8MXt2GmSHQ==", + "version": "10.2.0", + "resolved": "https://registry.npmjs.org/@storybook/addon-themes/-/addon-themes-10.2.0.tgz", + "integrity": "sha512-BJsBvxqMtBcZYKVOt0S8NRMAeOBXND5mtOr3ga7jRXDGMP6/BbFo/SBJ1QKjRTsXw/rsOfm6MKWc4jwgbuj4Nw==", "dev": true, "license": "MIT", "dependencies": { @@ -11603,17 +11671,17 @@ "url": "https://opencollective.com/storybook" }, "peerDependencies": { - "storybook": "^10.3.0" + "storybook": "^10.2.0" } }, "node_modules/@storybook/angular": { - "version": "10.3.0", - "resolved": "https://registry.npmjs.org/@storybook/angular/-/angular-10.3.0.tgz", - "integrity": "sha512-VEbIdKzF54CFaqncB2lItROFIzd+5BsgD18lU8c4ydqmI8vzn0ZkQpgohg1CDckFcL77FOkYhVF7qYQ96gIWnA==", + "version": "10.2.0", + "resolved": "https://registry.npmjs.org/@storybook/angular/-/angular-10.2.0.tgz", + "integrity": "sha512-nFqKZDYKZi2B3sC9ceDgtmJfRRzka0/N+desQy13N2YznLc/wTJxEFD68I3Cpk+c6UcYXXLs3b4ZvO8B4DJxpg==", "dev": true, "license": "MIT", "dependencies": { - "@storybook/builder-webpack5": "10.3.0", + "@storybook/builder-webpack5": "10.2.0", "@storybook/global": "^5.0.0", "telejson": "8.0.0", "ts-dedent": "^2.0.0", @@ -11637,7 +11705,7 @@ "@angular/platform-browser": ">=18.0.0 < 22.0.0", "@angular/platform-browser-dynamic": ">=18.0.0 < 22.0.0", "rxjs": "^6.5.3 || ^7.4.0", - "storybook": "^10.3.0", + "storybook": "^10.2.0", "typescript": "^4.9.0 || ^5.0.0", "zone.js": ">=0.14.0" }, @@ -11654,13 +11722,14 @@ } }, "node_modules/@storybook/builder-webpack5": { - "version": "10.3.0", - "resolved": "https://registry.npmjs.org/@storybook/builder-webpack5/-/builder-webpack5-10.3.0.tgz", - "integrity": "sha512-DNdJxLbbvx3Z4uQvk01uSQmbr4+OIl2leWhzpHwzX8aExX1jxybo9ekvzoEQDV5VrX2U8eFyzIfDIxeNBH4NbA==", + "version": "10.2.0", + "resolved": "https://registry.npmjs.org/@storybook/builder-webpack5/-/builder-webpack5-10.2.0.tgz", + "integrity": "sha512-p9pJRH5aq1uddy61iKksf0HLwK9AQyX8NFUdeKKCEtvLa94NPw4sMfJLyPrHZOmrrCC+H+DJJR5umqMlWff8sg==", "dev": true, "license": "MIT", "dependencies": { - "@storybook/core-webpack": "10.3.0", + "@storybook/core-webpack": "10.2.0", + "@vitest/mocker": "3.2.4", "case-sensitive-paths-webpack-plugin": "^2.4.0", "cjs-module-lexer": "^1.2.3", "css-loader": "^7.1.2", @@ -11681,7 +11750,7 @@ "url": "https://opencollective.com/storybook" }, "peerDependencies": { - "storybook": "^10.3.0" + "storybook": "^10.2.0" }, "peerDependenciesMeta": { "typescript": { @@ -11736,9 +11805,9 @@ } }, "node_modules/@storybook/core-webpack": { - "version": "10.3.0", - "resolved": "https://registry.npmjs.org/@storybook/core-webpack/-/core-webpack-10.3.0.tgz", - "integrity": "sha512-ppdX4LQoPLUbAyI0Gq6k/HNyiKSAUAeMP3bo0Li1ZmENqyjbDKpZ46h9K59m4fUwQoac7haAV+ifcUEsU23Nkw==", + "version": "10.2.0", + "resolved": "https://registry.npmjs.org/@storybook/core-webpack/-/core-webpack-10.2.0.tgz", + "integrity": "sha512-HGW9Y7kpgbkPtLsV1ALUCPXrBkcSpI0HGPsRuWqP3H3mQMHWxAFNLBRTd3+4egU+iOZQhj5mfePaWoTIwUY2Ag==", "dev": true, "license": "MIT", "dependencies": { @@ -11749,7 +11818,7 @@ "url": "https://opencollective.com/storybook" }, "peerDependencies": { - "storybook": "^10.3.0" + "storybook": "^10.2.0" } }, "node_modules/@storybook/global": { @@ -12400,17 +12469,17 @@ "license": "MIT" }, "node_modules/@typescript-eslint/eslint-plugin": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.60.0.tgz", - "integrity": "sha512-QYb/sa74/s7OKMbACMjrYnGspj9Hs5YI5aaffSL65UfeBUzVzBJfVo3oWSpbzPurvm7yaCCo2Lk7lVj610HqKw==", + "version": "8.59.4", + "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.59.4.tgz", + "integrity": "sha512-PegsU+XfyJJNjd4+u/k6f9yTyp0lEXXiPopUNobZcIAUJFGICFLN+sP0Rb3JehVmiij1Ph0dFGYqODoRo/2+6A==", "dev": true, "license": "MIT", "dependencies": { "@eslint-community/regexpp": "^4.12.2", - "@typescript-eslint/scope-manager": "8.60.0", - "@typescript-eslint/type-utils": "8.60.0", - "@typescript-eslint/utils": "8.60.0", - "@typescript-eslint/visitor-keys": "8.60.0", + "@typescript-eslint/scope-manager": "8.59.4", + "@typescript-eslint/type-utils": "8.59.4", + "@typescript-eslint/utils": "8.59.4", + "@typescript-eslint/visitor-keys": "8.59.4", "ignore": "^7.0.5", "natural-compare": "^1.4.0", "ts-api-utils": "^2.5.0" @@ -12423,7 +12492,7 @@ "url": "https://opencollective.com/typescript-eslint" }, "peerDependencies": { - "@typescript-eslint/parser": "8.60.0", + "@typescript-eslint/parser": "8.59.4", "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } @@ -12619,16 +12688,16 @@ } }, "node_modules/@typescript-eslint/parser": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.60.0.tgz", - "integrity": "sha512-fcqpj/MyK4sxDPcbe7STNPbpQL4RLZOPWuaTmwZYuc+hJKzRf58yRxfhqGpc6PIq9ZyfSBpfHgmUHmHs0KwHwg==", + "version": "8.59.4", + "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.59.4.tgz", + "integrity": "sha512-zORHqO/tuhxY1zWuTvMUqddRxpiFJ72xVfcNoWpqdLjs6lfPbuQBJuW4pk+49/uBMy7Ssr4bzgjiKmmDB1UbZQ==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/scope-manager": "8.60.0", - "@typescript-eslint/types": "8.60.0", - "@typescript-eslint/typescript-estree": "8.60.0", - "@typescript-eslint/visitor-keys": "8.60.0", + "@typescript-eslint/scope-manager": "8.59.4", + "@typescript-eslint/types": "8.59.4", + "@typescript-eslint/typescript-estree": "8.59.4", + "@typescript-eslint/visitor-keys": "8.59.4", "debug": "^4.4.3" }, "engines": { @@ -12644,14 +12713,14 @@ } }, "node_modules/@typescript-eslint/project-service": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.60.0.tgz", - "integrity": "sha512-aZu74NNKJeUWqCjDddzdiKaS82dgYgV/vmf+Ui3ZdZejmgfXR/q+pRumgobnQ2cCJTgGTWp4ypiwsuofFubavg==", + "version": "8.59.4", + "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.59.4.tgz", + "integrity": "sha512-Ly00Vu4oAacfDeHp2Zg85ioNG6l8HG+tN1D7J+xTHSxu9y0awYKJ2zH1rFBn8ZSfuGK+7FxK3Cgl3uAz0aZZLg==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/tsconfig-utils": "^8.60.0", - "@typescript-eslint/types": "^8.60.0", + "@typescript-eslint/tsconfig-utils": "^8.59.4", + "@typescript-eslint/types": "^8.59.4", "debug": "^4.4.3" }, "engines": { @@ -12666,14 +12735,14 @@ } }, "node_modules/@typescript-eslint/scope-manager": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.60.0.tgz", - "integrity": "sha512-pFzqhllJMs+jghLQWzV00ds39xLzuyqPSev5pd8f4Ir0rtKR3ZLUB4/4dhjOFighWb9larvtfJvqL+4yKDI3Xw==", + "version": "8.59.4", + "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.59.4.tgz", + "integrity": "sha512-mUeR/3H1WrTAddJrwut8OoPjfauaztMQmRwV5fQTUyNVJCLiUXXe4lGEyYIL2oFDpP7UtgbGJXCt72wT0z2S3Q==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.60.0", - "@typescript-eslint/visitor-keys": "8.60.0" + "@typescript-eslint/types": "8.59.4", + "@typescript-eslint/visitor-keys": "8.59.4" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -12684,9 +12753,9 @@ } }, "node_modules/@typescript-eslint/tsconfig-utils": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.60.0.tgz", - "integrity": "sha512-BZPR3RGYlAXnly6ymAxfkVn5rCbZzQNou0rxv3GfWZ8cTQp+hhVd73khbGLAd8k1TlAPLISH337M+tAgAnaJDQ==", + "version": "8.59.4", + "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.59.4.tgz", + "integrity": "sha512-DLCpnKgD4alVxTBSKulK+gU1KCqOgUXfDRDXh2mZgzokQKa/70ax93I2uVO3m/LLvIAtWZIFoiifudmIqAxpMA==", "dev": true, "license": "MIT", "engines": { @@ -12701,15 +12770,15 @@ } }, "node_modules/@typescript-eslint/type-utils": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.60.0.tgz", - "integrity": "sha512-SX46wEUtitCpq7AN38HkUU/+zvUpdKf7ephtWAFgckH8O7PQIyL5gvrhQgBLuEYgLfuKWOVvWVskMbuFHAz5xg==", + "version": "8.59.4", + "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.59.4.tgz", + "integrity": "sha512-uonTuPAAKr9XaBGqJ3LjYTh72zy5DyGesljO9gtmk/eFW0W1fRHjnwVYKB35Lm8d5Q5CluEW3gPHjTvZTmgrfA==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.60.0", - "@typescript-eslint/typescript-estree": "8.60.0", - "@typescript-eslint/utils": "8.60.0", + "@typescript-eslint/types": "8.59.4", + "@typescript-eslint/typescript-estree": "8.59.4", + "@typescript-eslint/utils": "8.59.4", "debug": "^4.4.3", "ts-api-utils": "^2.5.0" }, @@ -12726,9 +12795,9 @@ } }, "node_modules/@typescript-eslint/types": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.60.0.tgz", - "integrity": "sha512-AsE7x2XaAK+CVbeih0Fvbn+r1qHxtpLDJ3XUuFcIinT318T90yHMJC+Zgv+jUuDjQQd06HKwxnDu6sz1IcTilA==", + "version": "8.59.4", + "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.59.4.tgz", + "integrity": "sha512-F1o7WJcCq+bc8dwcO/YsSEOudAH8RDtaOhM6wcAQhcUsFhnWQl81JKy48q1hoxAU0qrzM89+31GYh1515Zde3Q==", "dev": true, "license": "MIT", "engines": { @@ -12740,16 +12809,16 @@ } }, "node_modules/@typescript-eslint/typescript-estree": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.60.0.tgz", - "integrity": "sha512-3AcZNBGMClm6CXDyo8kYvVGT/sx29sS0oBsIb9oZI2gunA4Vm2M3YHzRLPvsUBBsl+yB5FPtltq7gGH0iTlp9g==", + "version": "8.59.4", + "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.59.4.tgz", + "integrity": "sha512-F+RuOmcDXo4+TPdfd/TCLS3m2nw8gE9XXyZLrA3JBfaA5tz9TtdkyD3YJFmPxulyc2cKbEok/CvFE3MgSLWnag==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/project-service": "8.60.0", - "@typescript-eslint/tsconfig-utils": "8.60.0", - "@typescript-eslint/types": "8.60.0", - "@typescript-eslint/visitor-keys": "8.60.0", + "@typescript-eslint/project-service": "8.59.4", + "@typescript-eslint/tsconfig-utils": "8.59.4", + "@typescript-eslint/types": "8.59.4", + "@typescript-eslint/visitor-keys": "8.59.4", "debug": "^4.4.3", "minimatch": "^10.2.2", "semver": "^7.7.3", @@ -12781,16 +12850,16 @@ } }, "node_modules/@typescript-eslint/utils": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.60.0.tgz", - "integrity": "sha512-HtXuPfrHTyBDkameWpl+vJb1Uevu2tznAyahM1Oc4AENidCLTPiZDWIo4GfcxNdC/RcfGcadzzkqbRG87dUrQA==", + "version": "8.59.4", + "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.59.4.tgz", + "integrity": "sha512-cYXeNAUsG4lJo5dbc1FcKm+JwIWrj1/UpTORsC6tGMjEZ81DYcvIr9/ueikhMa/Y/gDQYGp+YX9/xQrXje5BJw==", "dev": true, "license": "MIT", "dependencies": { "@eslint-community/eslint-utils": "^4.9.1", - "@typescript-eslint/scope-manager": "8.60.0", - "@typescript-eslint/types": "8.60.0", - "@typescript-eslint/typescript-estree": "8.60.0" + "@typescript-eslint/scope-manager": "8.59.4", + "@typescript-eslint/types": "8.59.4", + "@typescript-eslint/typescript-estree": "8.59.4" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -12805,13 +12874,13 @@ } }, "node_modules/@typescript-eslint/visitor-keys": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.60.0.tgz", - "integrity": "sha512-9WI52t8ZGLVGrPMBet25yAftqY/n95+zmoUUtJBBQTKDSKUu7OsPTroT2op7U9JatkoRccL0YkWDNMFfC4Sjxg==", + "version": "8.59.4", + "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.59.4.tgz", + "integrity": "sha512-U3gxVaDVnuZKhSspW/MzMxE1kq7zOdc072FcSNoqA1I9p8HyKbBFfEHoWckBAMgNMph4MamwS5iTVzFmrnt8TQ==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.60.0", + "@typescript-eslint/types": "8.59.4", "eslint-visitor-keys": "^5.0.0" }, "engines": { @@ -13153,6 +13222,43 @@ "url": "https://opencollective.com/vitest" } }, + "node_modules/@vitest/mocker": { + "version": "3.2.4", + "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-3.2.4.tgz", + "integrity": "sha512-46ryTE9RZO/rfDd7pEqFl7etuyzekzEhUbTW3BvmeO/BcCMEgq59BKhek3dXDWgAj4oMK6OZi+vRr1wPW6qjEQ==", + "dev": true, + "license": "MIT", + "dependencies": { + "@vitest/spy": "3.2.4", + "estree-walker": "^3.0.3", + "magic-string": "^0.30.17" + }, + "funding": { + "url": "https://opencollective.com/vitest" + }, + "peerDependencies": { + "msw": "^2.4.9", + "vite": "^5.0.0 || ^6.0.0 || ^7.0.0-0" + }, + "peerDependenciesMeta": { + "msw": { + "optional": true + }, + "vite": { + "optional": true + } + } + }, + "node_modules/@vitest/mocker/node_modules/estree-walker": { + "version": "3.0.3", + "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz", + "integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==", + "dev": true, + "license": "MIT", + "dependencies": { + "@types/estree": "^1.0.0" + } + }, "node_modules/@vitest/pretty-format": { "version": "3.2.4", "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-3.2.4.tgz", @@ -13597,9 +13703,9 @@ } }, "node_modules/ajv": { - "version": "8.18.0", - "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.18.0.tgz", - "integrity": "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==", + "version": "8.20.0", + "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz", + "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==", "dev": true, "license": "MIT", "dependencies": { @@ -18784,14 +18890,14 @@ } }, "node_modules/eslint-plugin-prettier": { - "version": "5.5.5", - "resolved": "https://registry.npmjs.org/eslint-plugin-prettier/-/eslint-plugin-prettier-5.5.5.tgz", - "integrity": "sha512-hscXkbqUZ2sPithAuLm5MXL+Wph+U7wHngPBv9OMWwlP8iaflyxpjTYZkmdgB4/vPIhemRlBEoLrH7UC1n7aUw==", + "version": "5.5.6", + "resolved": "https://registry.npmjs.org/eslint-plugin-prettier/-/eslint-plugin-prettier-5.5.6.tgz", + "integrity": "sha512-ifetmTcxWfz+4qRW3pH/ujdTq2jQIj59AxJMIN26K5avYgU8dxycUETQonWiW+wPrYXA0j3Try0l1CnwVQtDqQ==", "dev": true, "license": "MIT", "dependencies": { "prettier-linter-helpers": "^1.0.1", - "synckit": "^0.11.12" + "synckit": "^0.11.13" }, "engines": { "node": "^14.18.0 || >=16.0.0" @@ -18837,9 +18943,9 @@ } }, "node_modules/eslint-plugin-storybook": { - "version": "10.3.0", - "resolved": "https://registry.npmjs.org/eslint-plugin-storybook/-/eslint-plugin-storybook-10.3.0.tgz", - "integrity": "sha512-8R0/RjELXkJ2RxPusX14ZiIj1So90bPnrjbxmQx1BD+4M2VoMHfn3n+6IvzJWQH4FT5tMRRUBqjLBe1fJjRRkg==", + "version": "10.2.0", + "resolved": "https://registry.npmjs.org/eslint-plugin-storybook/-/eslint-plugin-storybook-10.2.0.tgz", + "integrity": "sha512-OtQJ153FOusr8bIMzccjkfMFJEex/3NFx0iXZ+UaeQ0WXearQ+37EGgBay3onkFElyu8AySggq/fdTknPAEvPA==", "dev": true, "license": "MIT", "dependencies": { @@ -18847,7 +18953,7 @@ }, "peerDependencies": { "eslint": ">=8", - "storybook": "^10.3.0" + "storybook": "^10.2.0" } }, "node_modules/eslint-plugin-unicorn": { @@ -20605,9 +20711,9 @@ } }, "node_modules/graphql-ws": { - "version": "6.0.7", - "resolved": "https://registry.npmjs.org/graphql-ws/-/graphql-ws-6.0.7.tgz", - "integrity": "sha512-yoLRW+KRlDmnnROdAu7sX77VNLC0bsFoZyGQJLy1cF+X/SkLg/fWkRGrEEYQK8o2cafJ2wmEaMqMEZB3U3DYDg==", + "version": "6.0.8", + "resolved": "https://registry.npmjs.org/graphql-ws/-/graphql-ws-6.0.8.tgz", + "integrity": "sha512-m3EOaNsUBXwAnkBWbzPfe0Nq8pXUfxsWnolC54sru3FzHvhTZL0Ouf/BoQsaGAXqM+YPerXOJ47BUnmgmoupCw==", "license": "MIT", "engines": { "node": ">=20" @@ -33412,15 +33518,15 @@ } }, "node_modules/storybook": { - "version": "10.3.0", - "resolved": "https://registry.npmjs.org/storybook/-/storybook-10.3.0.tgz", - "integrity": "sha512-OpLdng98l7cACuqBoQwewx21Vhgl9XPssgLdXQudW0+N5QPjinWXZpZCquZpXpNCyw5s5BFAcv+jKB3Qkf9jeA==", + "version": "10.2.13", + "resolved": "https://registry.npmjs.org/storybook/-/storybook-10.2.13.tgz", + "integrity": "sha512-heMfJjOfbHvL+wlCAwFZlSxcakyJ5yQDam6e9k2RRArB1veJhRnsjO6lO1hOXjJYrqxfHA/ldIugbBVlCDqfvQ==", "dev": true, "license": "MIT", "dependencies": { "@storybook/global": "^5.0.0", "@storybook/icons": "^2.0.1", - "@testing-library/jest-dom": "^6.9.1", + "@testing-library/jest-dom": "^6.6.3", "@testing-library/user-event": "^14.6.1", "@vitest/expect": "3.2.4", "@vitest/spy": "3.2.4", @@ -34469,12 +34575,12 @@ } }, "node_modules/synckit": { - "version": "0.11.12", - "resolved": "https://registry.npmjs.org/synckit/-/synckit-0.11.12.tgz", - "integrity": "sha512-Bh7QjT8/SuKUIfObSXNHNSK6WHo6J1tHCqJsuaFDP7gP0fkzSfTxI8y85JrppZ0h8l0maIgc2tfuZQ6/t3GtnQ==", + "version": "0.11.13", + "resolved": "https://registry.npmjs.org/synckit/-/synckit-0.11.13.tgz", + "integrity": "sha512-eNRKgb3z66Yp3D2CixVujOUvXLFUTij/zVnV8KRyvFdQwpz7I5DS8UfRkTeLzb64u+dkzDSdelE24izu+zSSUg==", "license": "MIT", "dependencies": { - "@pkgr/core": "^0.2.9" + "@pkgr/core": "^0.3.6" }, "engines": { "node": "^14.18.0 || >=16.0.0" diff --git a/package.json b/package.json index 82c8687a75..d01a2a7b55 100644 --- a/package.json +++ b/package.json @@ -4,7 +4,7 @@ "version": "8.5.0", "author": "Hyland Software, Inc. and its affiliates", "scripts": { - "prepare": "husky", + "prepare": "node scripts/postinstall-security.mjs", "bundle:js-api": "nx run js-api:bundle", "bundle:cli": "nx run cli:bundle", "test:affected": "nx affected:test", @@ -52,20 +52,20 @@ "@apollo/client": "3.13.1", "@cspell/eslint-plugin": "10.0.0", "@mat-datetimepicker/core": "15.0.2", - "@ngx-translate/core": "^17.0.0", + "@ngx-translate/core": "17.0.0", "angular-oauth2-oidc": "19.0.0", "apollo-angular": "10.0.3", "chart.js": "4.4.4", "cropperjs": "1.6.2", - "date-fns": "^2.30.0", - "dotenv-expand": "^5.1.0", - "editorjs-html": "^4.0.5", - "eventemitter3": "^5.0.1", - "graphql-ws": "^6.0.5", - "material-icons": "^1.13.12", + "date-fns": "2.30.0", + "dotenv-expand": "5.1.0", + "editorjs-html": "4.0.5", + "eventemitter3": "5.0.4", + "graphql-ws": "6.0.8", + "material-icons": "1.13.14", "minimatch-browser": "1.0.0", - "ng2-charts": "^4.1.1", - "node-fetch": "^3.3.2", + "ng2-charts": "4.1.1", + "node-fetch": "3.3.2", "pdfjs-dist": "5.1.91", "raphael": "2.3.0", "rxjs": "7.8.2", @@ -90,60 +90,60 @@ "@nx/storybook": "22.7.4", "@nx/workspace": "22.7.4", "@schematics/angular": "19.2.22", - "@storybook/addon-themes": "^10.2.0", - "@storybook/angular": "^10.2.0", - "@types/ejs": "^3.1.5", + "@storybook/addon-themes": "10.2.0", + "@storybook/angular": "10.2.0", + "@types/ejs": "3.1.5", "@types/jasmine": "4.0.3", - "@types/jasminewd2": "~2.0.2", - "@types/jest": "^29.5.14", - "@types/jsdom": "^27.0.0", + "@types/jasminewd2": "2.0.13", + "@types/jest": "29.5.14", + "@types/jsdom": "27.0.0", "@types/minimatch": "5.1.2", "@types/node": "25.9.1", - "@typescript-eslint/eslint-plugin": "8.60.0", - "@typescript-eslint/parser": "8.60.0", - "@typescript-eslint/typescript-estree": "8.60.0", - "@typescript-eslint/utils": "^8.51.0", - "ajv": "^8.18.0", + "@typescript-eslint/eslint-plugin": "8.59.4", + "@typescript-eslint/parser": "8.59.4", + "@typescript-eslint/typescript-estree": "8.59.4", + "@typescript-eslint/utils": "8.59.4", + "ajv": "8.20.0", "dotenv": "16.4.7", - "ejs": "^3.1.10", - "eslint": "^8.47.0", + "ejs": "3.1.10", + "eslint": "8.57.1", "eslint-config-prettier": "10.1.8", - "eslint-plugin-ban": "^1.6.0", + "eslint-plugin-ban": "1.6.0", "eslint-plugin-import": "2.32.0", "eslint-plugin-jsdoc": "50.3.1", "eslint-plugin-license-header": "0.8.0", - "eslint-plugin-prettier": "^5.5.4", - "eslint-plugin-rxjs": "^5.0.3", - "eslint-plugin-storybook": "^10.2.0", - "eslint-plugin-unicorn": "^49.0.0", - "graphql": "^16.14.0", - "husky": "^9.1.7", + "eslint-plugin-prettier": "5.5.6", + "eslint-plugin-rxjs": "5.0.3", + "eslint-plugin-storybook": "10.2.0", + "eslint-plugin-unicorn": "49.0.0", + "graphql": "16.14.0", + "husky": "9.1.7", "jasmine-core": "5.13.0", - "jasmine-reporters": "^2.5.2", - "jest": "^29.7.0", - "jest-environment-jsdom": "^29.7.0", + "jasmine-reporters": "2.5.2", + "jest": "29.7.0", + "jest-environment-jsdom": "29.7.0", "jest-preset-angular": "14.4.2", - "jsdom": "^27.4.0", + "jsdom": "27.4.0", "karma": "6.4.4", - "karma-chrome-launcher": "~3.2.0", - "karma-coverage": "~2.2.0", + "karma-chrome-launcher": "3.2.0", + "karma-coverage": "2.2.1", "karma-jasmine": "5.1.0", - "karma-jasmine-html-reporter": "^2.1.0", + "karma-jasmine-html-reporter": "2.2.0", "lint-staged": "17.0.5", "ng-packagr": "19.2.2", "nx": "22.7.4", "prettier": "3.8.3", - "react": "^19.2.6", - "react-dom": "^19.2.6", - "rimraf": "^6.1.2", + "react": "19.2.6", + "react-dom": "19.2.6", + "rimraf": "6.1.3", "sass-loader": "16.0.8", - "spdx-license-list": "^6.11.0", - "storybook": "^10.2.13", + "spdx-license-list": "6.11.0", + "storybook": "10.2.13", "stylelint": "16.20.0", - "stylelint-config-standard-scss": "^13.1.0", - "ts-node": "^10.9.2", + "stylelint-config-standard-scss": "13.1.0", + "ts-node": "10.9.2", "typescript": "5.8.3", - "undici": "^8.3.0", + "undici": "8.3.0", "webpack": "5.107.2" }, "overrides": { @@ -151,7 +151,7 @@ "webpack": "5.107.2" }, "picomatch": "4.0.4", - "path-to-regexp": "^0.1.13", + "path-to-regexp": "0.1.13", "serialize-javascript": "7.0.5" }, "license": "Apache-2.0", diff --git a/scripts/check-security.mjs b/scripts/check-security.mjs new file mode 100644 index 0000000000..2c40e721d3 --- /dev/null +++ b/scripts/check-security.mjs @@ -0,0 +1,461 @@ +#!/usr/bin/env node + +/*! + * @license + * Copyright Ā© 2005-2025 Hyland Software, Inc. and its affiliates. All rights reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +/** + * Security check script - blocks npm install if compromised packages are detected. + * + * This script: + * 1. Fetches known malicious packages from multiple sources: + * - OSV (Open Source Vulnerabilities) - Google's aggregated database + * - GitHub Advisory Database - GitHub's security advisories + * 2. Checks both package.json and package-lock.json + * 3. Blocks installation if a compromised package is found + * + * Cache: Results are cached locally for 24 hours to avoid slowing down installs. + */ + +import { readFileSync, writeFileSync, existsSync, mkdirSync, rmSync } from 'fs'; +import { join, dirname } from 'path'; +import { fileURLToPath } from 'url'; +import { execSync } from 'child_process'; + +const __dirname = dirname(fileURLToPath(import.meta.url)); +const ROOT_DIR = join(__dirname, '..'); +const CACHE_DIR = join(ROOT_DIR, 'node_modules', '.cache', 'security-check'); +const CACHE_FILE = join(CACHE_DIR, 'blocked-packages.json'); +const CACHE_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours + +// API endpoints +const OSV_API = 'https://api.osv.dev/v1/query'; +const OSV_BATCH_API = 'https://api.osv.dev/v1/querybatch'; +const GITHUB_ADVISORY_API = 'https://api.github.com/advisories'; + +// Filter for supply chain attacks (malware, compromised packages) +// These are the most dangerous - not just vulnerabilities but intentionally malicious +const MALWARE_KEYWORDS = [ + 'malware', + 'malicious', + 'compromised', + 'supply chain', + 'backdoor', + 'cryptominer', + 'credential stealing', + 'data exfiltration', + 'typosquat' +]; + +// ============================================================================ +// FALLBACK LIST - Used when OSV is unreachable +// These are confirmed supply chain attacks (not regular CVEs) +// ============================================================================ +const FALLBACK_BLOCKED_PACKAGES = { + '@solana/web3.js': { + versions: ['1.95.6', '1.95.7'], + reason: 'Compromised - steals private keys (Dec 2024)' + }, + '@lottiefiles/lottie-player': { + versions: ['2.0.5', '2.0.6', '2.0.7'], + reason: 'Compromised - crypto wallet drainer (Oct 2024)' + }, + 'node-ipc': { + versions: ['9.2.2', '10.1.1', '10.1.2', '10.1.3', '11.0.0', '11.1.0'], + reason: 'Protestware - overwrites files (Mar 2022)' + }, + 'ua-parser-js': { + versions: ['0.7.29', '0.8.0', '1.0.0'], + reason: 'Compromised - cryptominer and password stealer (Oct 2021)' + }, + 'coa': { + versions: ['2.0.3', '2.0.4', '2.1.1', '2.1.3', '3.0.1', '3.1.3'], + reason: 'Compromised - password stealer (Nov 2021)' + }, + 'rc': { + versions: ['1.2.9', '1.3.9', '2.3.9'], + reason: 'Compromised - exfiltrates environment variables (Nov 2021)' + }, + 'colors': { + versions: ['1.4.1', '1.4.44-liberty-2'], + reason: 'Sabotage - infinite loop (Jan 2022)' + }, + 'faker': { + versions: ['6.6.6'], + reason: 'Sabotage - no functionality (Jan 2022)' + }, + 'event-stream': { + versions: ['3.3.6'], + reason: 'Compromised - bitcoin wallet theft (Nov 2018)' + } +}; + +// ============================================================================ +// DATABASE FETCHING +// ============================================================================ + +function isMalwareRelated(text) { + const lowerText = text.toLowerCase(); + return MALWARE_KEYWORDS.some(keyword => lowerText.includes(keyword.toLowerCase())); +} + +function extractVersionsFromOSV(vuln) { + const versions = []; + for (const affected of vuln.affected || []) { + for (const range of affected.ranges || []) { + for (const event of range.events || []) { + if (event.introduced && event.introduced !== '0') { + versions.push(event.introduced); + } + } + } + if (affected.versions) { + versions.push(...affected.versions); + } + } + return [...new Set(versions)]; +} + +async function fetchFromOSV(packages) { + console.log(' šŸ“” Fetching from OSV (Google)...'); + const results = {}; + + try { + const response = await fetch(OSV_BATCH_API, { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ + queries: Object.keys(packages).map(name => ({ + package: { name, ecosystem: 'npm' } + })) + }) + }); + + if (response.ok) { + const data = await response.json(); + for (const result of data.results || []) { + for (const vuln of result.vulns || []) { + const summary = [vuln.summary || '', vuln.details || ''].join(' '); + if (isMalwareRelated(summary)) { + const pkgName = vuln.affected?.[0]?.package?.name; + if (pkgName) { + const versions = extractVersionsFromOSV(vuln); + if (versions.length > 0) { + if (!results[pkgName]) { + results[pkgName] = { versions: [], reason: '' }; + } + results[pkgName].versions.push(...versions); + results[pkgName].reason = vuln.summary || 'Malware detected by OSV'; + results[pkgName].source = 'OSV'; + } + } + } + } + } + console.log(` āœ“ OSV: Found ${Object.keys(results).length} malware entries`); + } + } catch (e) { + console.log(` āš  OSV: Could not fetch (${e.message})`); + } + + return results; +} + +async function fetchFromGitHubAdvisory(packages) { + console.log(' šŸ“” Fetching from GitHub Advisory...'); + const results = {}; + + try { + // GitHub Advisory API - query for npm malware + // We search for advisories with malware-related keywords + const response = await fetch( + `${GITHUB_ADVISORY_API}?ecosystem=npm&type=malware&per_page=100`, + { + headers: { + 'Accept': 'application/vnd.github+json', + 'X-GitHub-Api-Version': '2022-11-28' + } + } + ); + + if (response.ok) { + const advisories = await response.json(); + for (const advisory of advisories) { + const summary = [advisory.summary || '', advisory.description || ''].join(' '); + + // Check each vulnerable package in this advisory + for (const vuln of advisory.vulnerabilities || []) { + const pkgName = vuln.package?.name; + if (pkgName && vuln.package?.ecosystem === 'npm') { + // Extract affected versions + const versions = []; + if (vuln.vulnerable_version_range) { + // Parse version range like "= 1.95.6" or ">= 1.0.0, < 1.0.1" + const exactMatch = vuln.vulnerable_version_range.match(/^= (.+)$/); + if (exactMatch) { + versions.push(exactMatch[1]); + } + } + if (vuln.first_patched_version?.identifier) { + // This tells us the fixed version, not the bad ones + // We'd need to know the introduced version too + } + + if (versions.length > 0 || isMalwareRelated(summary)) { + if (!results[pkgName]) { + results[pkgName] = { versions: [], reason: '' }; + } + results[pkgName].versions.push(...versions); + results[pkgName].reason = advisory.summary || 'Malware detected by GitHub Advisory'; + results[pkgName].source = 'GitHub'; + } + } + } + } + console.log(` āœ“ GitHub: Found ${Object.keys(results).length} malware entries`); + } else if (response.status === 403) { + console.log(' āš  GitHub: Rate limited (will use cached/fallback data)'); + } + } catch (e) { + console.log(` āš  GitHub: Could not fetch (${e.message})`); + } + + return results; +} + +async function fetchMalwareList() { + // Check cache first + if (existsSync(CACHE_FILE)) { + try { + const cache = JSON.parse(readFileSync(CACHE_FILE, 'utf8')); + if (Date.now() - cache.timestamp < CACHE_TTL_MS) { + console.log(' Using cached security database...'); + console.log(` (${cache.sources?.join(', ') || 'fallback'} - cached ${Math.round((Date.now() - cache.timestamp) / 60000)} min ago)`); + return cache.packages; + } + } catch { + // Cache corrupted, will refetch + } + } + + console.log(' Fetching latest security databases...\n'); + + // Start with fallback list + const packages = { ...FALLBACK_BLOCKED_PACKAGES }; + const sources = ['fallback']; + + // Fetch from OSV + const osvResults = await fetchFromOSV(packages); + if (Object.keys(osvResults).length > 0) { + sources.push('OSV'); + for (const [name, data] of Object.entries(osvResults)) { + if (packages[name]) { + // Merge versions + packages[name].versions = [...new Set([...packages[name].versions, ...data.versions])]; + } else { + packages[name] = data; + } + } + } + + // Fetch from GitHub Advisory + const ghResults = await fetchFromGitHubAdvisory(packages); + if (Object.keys(ghResults).length > 0) { + sources.push('GitHub'); + for (const [name, data] of Object.entries(ghResults)) { + if (packages[name]) { + // Merge versions + packages[name].versions = [...new Set([...packages[name].versions, ...data.versions])]; + } else { + packages[name] = data; + } + } + } + + console.log(''); + + // Cache results + try { + if (!existsSync(CACHE_DIR)) { + mkdirSync(CACHE_DIR, { recursive: true }); + } + writeFileSync(CACHE_FILE, JSON.stringify({ + timestamp: Date.now(), + sources, + packages + }, null, 2)); + } catch { + // Cache write failed, continue anyway + } + + return packages; +} + +// ============================================================================ +// PACKAGE CHECKING +// ============================================================================ + +function readJsonFile(filePath) { + if (!existsSync(filePath)) { + return null; + } + try { + return JSON.parse(readFileSync(filePath, 'utf8')); + } catch (e) { + console.error(` Failed to parse ${filePath}: ${e.message}`); + return null; + } +} + +function checkVersion(version, blockedVersions) { + return blockedVersions.some(blocked => blocked === version); +} + +function checkDependencies(deps, blockedPackages, source) { + const violations = []; + if (!deps) return violations; + + for (const [name, versionSpec] of Object.entries(deps)) { + if (blockedPackages[name]) { + const version = versionSpec.replace(/^[\^~>=<]*/, '').split(' ')[0]; + if (checkVersion(version, blockedPackages[name].versions)) { + violations.push({ + package: name, + version, + reason: blockedPackages[name].reason, + source + }); + } + } + } + return violations; +} + +function checkLockfileDependencies(packages, blockedPackages) { + const violations = []; + if (!packages) return violations; + + for (const [path, info] of Object.entries(packages)) { + if (!path || path === '') continue; + const name = path.replace(/^node_modules\//, '').replace(/^.*node_modules\//, ''); + + if (blockedPackages[name] && info.version) { + if (checkVersion(info.version, blockedPackages[name].versions)) { + violations.push({ + package: name, + version: info.version, + reason: blockedPackages[name].reason, + source: 'package-lock.json (transitive)' + }); + } + } + } + return violations; +} + +// ============================================================================ +// MAIN +// ============================================================================ + +async function main() { + console.log('\n' + '='.repeat(70)); + console.log('šŸ”’ ADF SECURITY CHECK'); + console.log('='.repeat(70)); + console.log('Scanning for known supply chain attacks and compromised packages...\n'); + + // Fetch blocked packages list + const blockedPackages = await fetchMalwareList(); + const threatCount = Object.keys(blockedPackages).length; + + const violations = []; + + // Check package.json + const packageJson = readJsonFile(join(ROOT_DIR, 'package.json')); + if (packageJson) { + violations.push(...checkDependencies(packageJson.dependencies, blockedPackages, 'package.json (dependencies)')); + violations.push(...checkDependencies(packageJson.devDependencies, blockedPackages, 'package.json (devDependencies)')); + } + + // Check package-lock.json + const lockfile = readJsonFile(join(ROOT_DIR, 'package-lock.json')); + if (lockfile?.packages) { + violations.push(...checkLockfileDependencies(lockfile.packages, blockedPackages)); + } + + // Deduplicate + const uniqueViolations = violations.filter((v, i, arr) => + arr.findIndex(x => x.package === v.package && x.version === v.version) === i + ); + + if (uniqueViolations.length > 0) { + console.error('\n' + '='.repeat(70)); + console.error('šŸšØ SECURITY ALERT: MALICIOUS PACKAGES DETECTED šŸšØ'); + console.error('='.repeat(70) + '\n'); + + console.error('The following packages are known to be COMPROMISED:\n'); + + for (const v of uniqueViolations) { + console.error(` šŸ“¦ ${v.package}@${v.version}`); + console.error(` āš ļø ${v.reason}`); + console.error(` šŸ“ Found in: ${v.source}\n`); + } + + console.error('='.repeat(70)); + console.error('ā›” INSTALLATION BLOCKED FOR YOUR SECURITY'); + console.error('='.repeat(70) + '\n'); + + console.error('These packages contain malicious code that may:'); + console.error(' ā€¢ Steal credentials and environment variables'); + console.error(' ā€¢ Install cryptominers or backdoors'); + console.error(' ā€¢ Exfiltrate sensitive data\n'); + + // Delete node_modules to prevent using compromised packages + const nodeModulesPath = join(ROOT_DIR, 'node_modules'); + if (existsSync(nodeModulesPath)) { + console.error('šŸ—‘ļø Removing node_modules to prevent use of compromised packages...\n'); + try { + rmSync(nodeModulesPath, { recursive: true, force: true }); + console.error('āœ… node_modules deleted successfully.\n'); + } catch (e) { + console.error(`āš ļø Could not delete node_modules: ${e.message}`); + console.error(' Please delete it manually before proceeding.\n'); + } + } + + console.error('šŸ“‹ REQUIRED ACTIONS:'); + console.error(' 1. Review your package.json for the affected packages'); + console.error(' 2. Update to safe versions or remove the packages'); + console.error(' 3. Delete package-lock.json and regenerate it'); + console.error(' 4. Run npm install again\n'); + + console.error('šŸ“š More information:'); + console.error(' ā€¢ https://osv.dev'); + console.error(' ā€¢ https://socket.dev/npm/advisories'); + console.error(' ā€¢ https://github.com/advisories\n'); + + process.exit(1); + } + + console.log(`āœ… Security check passed (${threatCount} known threats checked)`); + console.log('='.repeat(70) + '\n'); + process.exit(0); +} + +main().catch(err => { + console.error('Security check failed:', err.message); + // Don't block install if script itself fails + process.exit(0); +}); diff --git a/scripts/postinstall-security.mjs b/scripts/postinstall-security.mjs new file mode 100644 index 0000000000..9108c09bfe --- /dev/null +++ b/scripts/postinstall-security.mjs @@ -0,0 +1,160 @@ +#!/usr/bin/env node + +/*! + * @license + * Copyright Ā© 2005-2025 Hyland Software, Inc. and its affiliates. All rights reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +/** + * Post-install Security Script + * + * This runs after `npm install` / `npm ci` (via prepare hook). + * Since .npmrc has ignore-scripts=true, no package scripts run during install. + * + * This script: + * 1. Runs security check against OSV + GitHub Advisory + * 2. If safe, rebuilds only trusted packages that need native bindings + * 3. Sets up husky + */ + +import { execSync } from 'child_process'; +import { existsSync } from 'fs'; +import { join, dirname } from 'path'; +import { fileURLToPath } from 'url'; + +const __dirname = dirname(fileURLToPath(import.meta.url)); +const ROOT_DIR = join(__dirname, '..'); + +// Packages that are trusted to run postinstall/install scripts +// These typically need to compile native bindings or setup tooling +const TRUSTED_PACKAGES = [ + 'esbuild', + 'sharp', + 'node-sass', + 'sass', + 'pdfjs-dist', + 'canvas', + 'bcrypt', + 'sqlite3', + 'better-sqlite3', + 'puppeteer', + 'playwright', + 'fsevents', + 'nx', + 'husky', + 'core-js', + 'core-js-pure' +]; + +// Scoped packages that need rebuild (full package names) +const TRUSTED_SCOPED_PACKAGES = [ + '@esbuild/darwin-arm64', + '@esbuild/darwin-x64', + '@esbuild/linux-x64', + '@esbuild/win32-x64', + '@parcel/watcher', + '@nx/nx-darwin-arm64', + '@nx/nx-darwin-x64', + '@nx/nx-linux-x64-gnu', + '@nx/nx-linux-x64-musl', + '@nx/nx-win32-x64-msvc', + '@swc/core' +]; + +function run(command, options = {}) { + try { + execSync(command, { + stdio: 'inherit', + cwd: ROOT_DIR, + ...options + }); + return true; + } catch { + return false; + } +} + +function getInstalledTrustedPackages() { + const nodeModulesPath = join(ROOT_DIR, 'node_modules'); + if (!existsSync(nodeModulesPath)) return []; + + const installed = []; + + // Check non-scoped packages + for (const pkg of TRUSTED_PACKAGES) { + const pkgPath = join(nodeModulesPath, pkg); + if (existsSync(pkgPath)) { + installed.push(pkg); + } + } + + // Check scoped packages + for (const pkg of TRUSTED_SCOPED_PACKAGES) { + const [scope, name] = pkg.split('/'); + const pkgPath = join(nodeModulesPath, scope, name); + if (existsSync(pkgPath)) { + installed.push(pkg); + } + } + + return [...new Set(installed)]; +} + +async function main() { + console.log('\n' + '='.repeat(70)); + console.log('šŸ”’ ADF POST-INSTALL SECURITY'); + console.log('='.repeat(70) + '\n'); + + // Step 1: Run security check + console.log('Step 1/3: Running security check...\n'); + const securityCheckPath = join(__dirname, 'check-security.mjs'); + + // Run security check as subprocess (it calls process.exit) + const securityPassed = run(`node "${securityCheckPath}"`); + if (!securityPassed) { + console.error('\nāŒ Security check failed - installation aborted\n'); + process.exit(1); + } + + // Step 2: Rebuild trusted packages + console.log('\nStep 2/3: Rebuilding trusted packages...\n'); + const trustedInstalled = getInstalledTrustedPackages(); + + if (trustedInstalled.length > 0) { + console.log('Trusted packages to rebuild:'); + trustedInstalled.forEach(pkg => console.log(` āœ“ ${pkg}`)); + console.log(''); + + run(`npm rebuild ${trustedInstalled.join(' ')}`); + } else { + console.log('No trusted packages require rebuilding.\n'); + } + + // Step 3: Setup husky + console.log('Step 3/3: Setting up husky...\n'); + const huskyPath = join(ROOT_DIR, 'node_modules', 'husky'); + if (existsSync(huskyPath)) { + run('npx husky'); + } + + console.log('='.repeat(70)); + console.log('āœ… Post-install security complete'); + console.log('='.repeat(70) + '\n'); +} + +main().catch(err => { + console.error('Post-install failed:', err.message); + process.exit(1); +});