milliways-infosec/AikidoSec-safe-chain
7
0
Fork 0
mirror of https://github.com/AikidoSec/safe-chain.git synced 2026-05-26 12:10:49 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Exit installation instead of prompting the user

Browse source
This commit is contained in:
Sander Declerck 2025-09-11 13:42:45 +02:00
parent 0cb9562857
commit 2f1692e253
No known key found for this signature in database
7 changed files with 297 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

28
packages/safe-chain/src/scanning/index.js
View file

@ -4,6 +4,7 @@ import { setTimeout } from "timers/promises";
import chalk from "chalk";
import { getPackageManager } from "../packagemanager/currentPackageManager.js";
import { ui } from "../environment/userInteraction.js";
import { getMalwareAction, MALWARE_ACTION_PROMPT } from "../config/settings.js";
export function shouldScanCommand(args) {
if (!args || args.length === 0) {
@ -59,10 +60,7 @@ export async function scanCommand(args) {
spinner.succeed("No malicious packages detected.");
} else {
printMaliciousChanges(audit.disallowedChanges, spinner);
await acceptRiskOrExit(
"Do you want to continue with the installation despite the risks?",
false
);
await onMalwareFound();
}
}
@ -74,19 +72,23 @@ function printMaliciousChanges(changes, spinner) {
}
}
async function acceptRiskOrExit(message, defaultValue) {
async function onMalwareFound() {
ui.emptyLine();
const continueInstall = await ui.confirm({
message: message,
default: defaultValue,
});
if (continueInstall) {
ui.writeInformation("Continuing with the installation...");
return;
if (getMalwareAction() === MALWARE_ACTION_PROMPT) {
const continueInstall = await ui.confirm({
message:
"Malicious packages were found. Do you want to continue with the installation?",
default: false,
});
if (continueInstall) {
ui.writeWarning("Continuing with the installation despite the risks...");
return;
}
}
ui.writeInformation("Exiting without installing packages.");
ui.writeError("Exiting without installing malicious packages.");
ui.emptyLine();
process.exit(1);
}