npmpackage.info

Gathering detailed insights and metrics for lockfile-lint-api

Other packages similar to lockfile-lint-api

@types/lockfile-lint-api

5.1.5

TypeScript definitions for lockfile-lint-api

@ellentorg/nostrum-exercitationem-facilis

6.16.146

A _very_ minimal implementation of a [PassThrough stream](https://nodejs.org/api/stream.html#stream_class_stream_passthrough)

@womorg/ipsam-sint-eaque

3.10.131

> Dependency-less Test Runner for Node.js

@hishprorg/assumenda-tempora-eius

1.4.19

Node [streams2](http://nodejs.org/api/stream.html) over [Primus](https://github.com/primus/primus): added back-pressure!

Gathering detailed insights and metrics for lockfile-lint-api

lockfile-lint-api

Lint an npm or yarn lockfile to analyze and detect security issues

5.9.1

788

Apache-2.0

JavaScript

41.68 kB

19,493,344 3.8

Installations

npm install lockfile-lint-api

Developer Guide

BETA

Typescript

No

Module System

CommonJS

Min. Node Version

>=16.0.0

Node Version

18.19.0

NPM Version

10.2.3 Score

86.8

Supply Chain

99.4

Quality

Maintenance

100

Vulnerability

100

License

Pull Requests

Open

0

Total

125

Closed

14

Merged

111

Issues

Open

2

Total

77

Closed

75

Releases

lockfile-lint@4.14.0

Published on 14 Jun 2024

lockfile-lint@4.13.2

Published on 21 Feb 2024

lockfile-lint-api@5.9.1

Published on 11 Feb 2024

lockfile-lint@4.13.1

Published on 11 Feb 2024

lockfile-lint@4.13.0

Published on 11 Feb 2024

lockfile-lint-api@5.9.0

Published on 11 Feb 2024

View all 13 releases

Contributors

Unable to fetch Contributors

View all 35 contributors

Languages

JavaScript

Shell

JavaScript (99.69%)

Shell (0.31%)

Developer

lirantal

Download Statistics

Total Downloads

19,493,344

Last Day

7,997

Last Week

160,705

Last Month

848,312

Last Year

5,885,184

GitHub Statistics

788 Stars

277 Commits

35 Forks

9 Watching

14 Branches

35 Contributors

Maintainers

Package Meta Information

Latest Version

5.9.1

Package Id

lockfile-lint-api@5.9.1

Unpacked Size

41.68 kB

Size

11.80 kB

File Count

NPM Version

10.2.3

Node Version

18.19.0

Publised On

11 Feb 2024

Total Downloads

Cumulative downloads

Total Downloads

19,493,344

Last day

-34.1%

7,997

Compared to previous day

Last week

-25.1%

160,705

Compared to previous week

Last month

22.4%

848,312

Compared to previous month

Last year

34.6%

5,885,184

Compared to previous year

Daily Downloads

Weekly Downloads

Monthly Downloads

Yearly Downloads

Versions

lockfile-lint-api

Lint an npm or yarn lockfile to analyze and detect issues

About

Lints an npm or yarn lockfile to analyze and detect issues

Install

1npm install --save lockfile-lint-api

Usage

lockfile-lint-api exposes a set of validator APIs that can be used for programmatic use-cases, such as being employed by other tools and programs if needed.

Validators

The following lockfile validators are supported

Validator API	description	implemented
ValidateHttps	validates the use of HTTPS as protocol schema for all resources	✅
ValidateHost	validates a whitelist of allowed hosts to be used for resources in the lockfile	✅
ValidatePackageNames	validates that the resolved URL matches the package name	✅
ValidateScheme	validates a whitelist of allowed URI schemes to be used for hosts	✅
ValidateIntegrity	validates that the integrity hash type is sha512	✅

NOTE: package entries without a resolved field (for example, those installed from the local filesystem) will automatically pass all url-based validators.

Success and failures

When validators encounter errors they will throw an exception, and on either success or failure in validating data they will always return a descriptive object for the validation task.

Successful validation

When validation is successful the following object will be returned from the validating function:

1{
2  "type": "success",
3  "errors": []
4}

Failed validation

When validation has failed the following object will be returned from the validating function:

1{
2  "type": "error",
3  "errors": [
4    {
5      "package": "@babel/cli",
6      "message": "detected invalid origin for package: @babel/cli"
7    }
8  ]
9}

Notes about the returned object:

An errors object will always return an array of errors metadata, even if there's only one error associated with the validation being performed
All errors should always have a message
The availability of the package property and other metadata depends on the specific validators being used

Example

1const validator = new ValidateHost({packages: lockfile.object})
2let result
3try {
4  result = validator.validate(['npm'])
5} catch (error) {
6  // something bad happened during validation and the validation
7  // process couldn't take place
8}
9
10console.log(result)
11/* prints
12{
13  "type": "error",
14  "errors": [
15    {
16      "message": "detected invalid origin for package: meow",
17      "package": "meow"
18    }
19  ]
20}
21*/

Example

1const {ValidateHost, ParseLockfile} = require('lockfile-lint-api')
2
3// path to the lockfile
4const yarnLockfilePath = '/path/to/my/yarn.lock'
5const options = {
6  lockfilePath: yarnLockfilePath
7}
8
9// instantiate a new parser with options object
10const parser = new ParseLockfile(options)
11
12// read the file synchronously and parses it
13// providing back an object that is compatible
14// with the @yarn/lockfile library which has
15// all the packages listed in `lockfile.object`
16const lockfile = parser.parseSync()
17
18// now instantiate a validator object with those
19// list of packages
20const validator = new ValidateHost({packages: lockfile.object})
21let result
22try {
23  // validation is synchronous and is being called
24  // with 'npm' as a shortcut for the npm registry
25  // host to validate all lockfile resources are
26  // whitelisted to the npm host
27  result = validator.validate(['npm'])
28} catch (error) {
29  // couldn't process the validation
30}
31
32if (result.type === 'success') {
33  // validation succeeded
34}

Contributing

Please consult CONTRIBUTING for guidelines on contributing to this project.

Author

No vulnerabilities found.

10

Security-Policy

Determines if the project has published a security policy.

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

License

Determines if the project has defined a license.

3

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

1

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

0

Maintained

Determines if the project is "actively maintained".

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Fuzzing

Determines if the project uses fuzzing.

0

SAST

Determines if the project uses static code analysis.

0

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

Score

3.8

/10

Last Scanned on 2024-12-16

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More

Other packages similar to lockfile-lint-api

lockfile-lint-api

Installations

Developer Guide

No

CommonJS

>=16.0.0

18.19.0

10.2.3

Score

Pull Requests

0

125

14

111

Issues

2

77

75

Releases

Contributors

Unable to fetch Contributors

Languages

Developer

lirantal

Download Statistics

GitHub Statistics

Maintainers

Package Meta Information

Total Downloads

19,493,344

Daily Downloads

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

Dev Dependencies

lockfile-lint-api

About

Install

Usage

Validators

Success and failures

Successful validation

Failed validation

Example

Example

Contributing

Author

10

10

10

10

3

1

0

0

0

0

0

0

3.8

/10

Other packages similar to lockfile-lint-api