nodesecure / authors Goto Github PK

Our tests must be refacto, we must execute temp.js to create the nsecure-result.json which will be analyzed by the package.

We want to remove this file and include the step in our tests.

The second improvement consist in what Rossbob told me in another PR

I would have added some tests over rewriting it :

• one without any options (flags & domainInformations)
• one with flags
• one with domainInformations

but it may be overkill

Originally posted by @Rossb0b in #12 (review)

It would be relevant to know if a maintainer is still active on npm. This would probably only be possible if the person has already published a package.

For example, we could consider that someone who has published in the past but nothing within three years would be considered as not active.

Any help or opinions are welcome.

Author and Maintainer with an expired email domain are exposed to hackers.

See: What are Weak Links in the npm Supply Chain?

How could we identify and prevent this with code ? That's the subject of this issue.

We should implement authors inside:

• @nodesecure/rc => add an array of flaggedAuthors
• @nodesecure/scanner => use authors

It would be interesting to tag specific authors.

For example. if I wanna know how many packages from my dependencies depend on Fraxken. I would be able to do something like

import { extractAndOptimizeUsers } from "@nodesecure/authors";

interface flagAuthor {
  name: string,
  email: string,
  foundIn: string[], // packages names
}

const flagAuthors = [
  { name: 'Fraxken', email: '...' }
]
const { authors, flagAuthors } = extractAndOptimizeUsers({ authors, flagAuthors });