Merge remote-tracking branch 'origin/main' into pip-custom-registries

packages/safe-chain/src/registryProxy/certBundle.js

@@ -6,6 +6,7 @@ import certifi from "certifi";
 import tls from "node:tls";
 import { X509Certificate } from "node:crypto";
 import { getCaCertPath } from "./certUtils.js";
+import { ui } from "../environment/userInteraction.js";
 
 /**
  * Check if a PEM string contains only parsable cert blocks.
@@ -14,6 +15,7 @@ import { getCaCertPath } from "./certUtils.js";
  */
 function isParsable(pem) {
   if (!pem || typeof pem !== "string") return false;
+  pem = normalizeLineEndings(pem);
   const begin = "-----BEGIN CERTIFICATE-----";
   const end = "-----END CERTIFICATE-----";
   const blocks = [];
@@ -41,20 +43,17 @@ function isParsable(pem) {
   }
 }
 
-/** @type {string | null} */
-let cachedPath = null;
-
 /**
- * Build a combined CA bundle for Python and Node HTTPS flows.
- * - Includes Safe Chain CA (for MITM of known registries)
- * - Includes Mozilla roots via npm `certifi` (public HTTPS)
- * - Includes Node's built-in root certificates as a portable fallback
+ * Build a combined CA bundle.
+ * Automatically includes:
+ * - Safe Chain CA (for MITM of known registries)
+ * - Mozilla roots via certifi (for public HTTPS)
+ * - Node's built-in root certificates (fallback)
+ * - User's custom certificates (if NODE_EXTRA_CA_CERTS environment variable is set)
+ * 
  * @returns {string} Path to the combined CA bundle PEM file
  */
 export function getCombinedCaBundlePath() {
-  if (cachedPath && fs.existsSync(cachedPath)) return cachedPath;
-
-  // Concatenate PEM files
   const parts = [];
 
   // 1) Safe Chain CA (for MITM'd registries)
@@ -87,9 +86,96 @@ export function getCombinedCaBundlePath() {
     // Ignore if unavailable
   }
 
+  // 4) User's NODE_EXTRA_CA_CERTS (if set)
+  const userCertPath = process.env.NODE_EXTRA_CA_CERTS;
+  if (userCertPath) {
+    const userPem = readUserCertificateFile(userCertPath);
+    if (userPem) {
+      parts.push(userPem.trim());
+      ui.writeVerbose(`Safe-chain: Merging user's NODE_EXTRA_CA_CERTS from ${userCertPath}`);
+    } else {
+      ui.writeWarning(`Safe-chain: Could not read or parse user's NODE_EXTRA_CA_CERTS from ${userCertPath}`);
+    }
+  }
+
   const combined = parts.filter(Boolean).join("\n");
-  const target = path.join(os.tmpdir(), "safe-chain-ca-bundle.pem");
+  const target = path.join(os.tmpdir(), `safe-chain-ca-bundle-${Date.now()}.pem`);
   fs.writeFileSync(target, combined, { encoding: "utf8" });
-  cachedPath = target;
-  return cachedPath;
+  return target;
 }
+
+/**
+ * Normalize path
+ * @param {string} p - Path to normalize
+ * @returns {string}
+ */
+function normalizePathF(p) {
+  return p.replace(/\\/g, "/");
+}
+
+/**
+ * Normalize line endings to LF
+ * @param {string} text - Text with mixed line endings
+ * @returns {string}
+ */
+function normalizeLineEndings(text) {
+  return text.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+}
+
+/**
+ * Read and validate user certificate file
+ * @param {string} certPath - Path to certificate file
+ * @returns {string | null} Certificate PEM content or null if invalid/unreadable
+ */
+function readUserCertificateFile(certPath) {
+  try {
+    // 1) Basic validation
+    if (typeof certPath !== "string" || certPath.trim().length === 0) {
+      return null;
+    }
+
+    // 2) Reject path traversal attempts (normalize backslashes first for Windows paths)
+    const normalizedPath = normalizePathF(certPath);
+    if (normalizedPath.includes("..")) {
+      return null;
+    }
+
+    // 3) Check if file exists and is not a directory or symlink
+    let stats;
+    try {
+      stats = fs.lstatSync(certPath);
+    } catch {
+      // File doesn't exist or can't be accessed
+      return null;
+    }
+
+    if (!stats.isFile()) {
+      // Reject directories and symlinks
+      return null;
+    }
+
+    // 4) Read file content
+    let content;
+    try {
+      content = fs.readFileSync(certPath, "utf8");
+    } catch {
+      return null;
+    }
+
+    if (!content || typeof content !== "string") {
+      return null;
+    }
+
+    // 5) Validate PEM format
+    if (!isParsable(content)) {
+      return null;
+    }
+
+    return content;
+  } catch {
+    // Silently fail on any errors
+    return null;
+  }
+}
+
+

packages/safe-chain/src/registryProxy/certBundle.spec.js

@@ -15,6 +15,13 @@ function removeBundleIfExists() {
   }
 }
 
+// Utility to get a valid PEM certificate for testing
+function getValidCert() {
+  const cert = typeof tls.rootCertificates?.[0] === "string" ? tls.rootCertificates[0] : "";
+  assert.ok(cert.includes("BEGIN CERTIFICATE"), "Environment lacks Node root certificates for test");
+  return cert;
+}
+
 describe("certBundle.getCombinedCaBundlePath", () => {
   beforeEach(() => {
     mock.restoreAll();
@@ -69,3 +76,304 @@ describe("certBundle.getCombinedCaBundlePath", () => {
     assert.ok(!contents.includes(invalidMarker), "Bundle should not include invalid Safe Chain content");
   });
 });
+
+describe("certBundle.getCombinedCaBundlePath with user certs", () => {
+  beforeEach(() => {
+    mock.restoreAll();
+    delete process.env.NODE_EXTRA_CA_CERTS;
+  });
+
+  it("returns a path with full CA bundle (Safe Chain + Mozilla + Node roots) when no user cert in env", async () => {
+    // Mock getCaCertPath to return valid cert
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "certtest-"));
+    const safeChainPath = path.join(tmpDir, "safechain.pem");
+    fs.writeFileSync(safeChainPath, getValidCert(), "utf8");
+
+    mock.module("./certUtils.js", {
+      namedExports: {
+        getCaCertPath: () => safeChainPath,
+      },
+    });
+
+    const { getCombinedCaBundlePath } = await import("./certBundle.js");
+    const bundlePath = getCombinedCaBundlePath();
+
+    assert.ok(fs.existsSync(bundlePath), "Bundle path should exist");
+    const contents = fs.readFileSync(bundlePath, "utf8");
+    assert.match(contents, /-----BEGIN CERTIFICATE-----/, "Should contain certificate blocks");
+    // Should include base bundle (Safe Chain + Mozilla/Node roots)
+    assert.ok(contents.length > 1000, "Bundle should be substantial with Mozilla/Node roots included");
+  });
+
+  it("merges user cert with full base bundle (Safe Chain CA + Mozilla + Node roots)", async () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "certtest-"));
+    
+    // Create Safe Chain CA
+    const safeChainPath = path.join(tmpDir, "safechain.pem");
+    const safeChainCert = getValidCert();
+    fs.writeFileSync(safeChainPath, safeChainCert, "utf8");
+
+    // Create user cert file
+    const userCertPath = path.join(tmpDir, "user-cert.pem");
+    const userCert = getValidCert();
+    fs.writeFileSync(userCertPath, userCert, "utf8");
+    process.env.NODE_EXTRA_CA_CERTS = userCertPath;
+
+    mock.module("./certUtils.js", {
+      namedExports: {
+        getCaCertPath: () => safeChainPath,
+      },
+    });
+
+    const { getCombinedCaBundlePath } = await import("./certBundle.js");
+    const bundlePath = getCombinedCaBundlePath();
+
+    assert.ok(fs.existsSync(bundlePath), "Bundle path should exist");
+    const contents = fs.readFileSync(bundlePath, "utf8");
+    
+    // Both certs should be in the bundle
+    const certCount = (contents.match(/-----BEGIN CERTIFICATE-----/g) || []).length;
+    assert.ok(certCount >= 2, "Bundle should contain both Safe Chain and user certificates");
+  });
+
+  it("ignores non-existent user cert path", async () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "certtest-"));
+    const safeChainPath = path.join(tmpDir, "safechain.pem");
+    fs.writeFileSync(safeChainPath, getValidCert(), "utf8");
+    process.env.NODE_EXTRA_CA_CERTS = "/nonexistent/path.pem";
+
+    mock.module("./certUtils.js", {
+      namedExports: {
+        getCaCertPath: () => safeChainPath,
+      },
+    });
+
+    const { getCombinedCaBundlePath } = await import("./certBundle.js");
+    const bundlePath = getCombinedCaBundlePath();
+
+    assert.ok(fs.existsSync(bundlePath), "Bundle path should exist");
+    const contents = fs.readFileSync(bundlePath, "utf8");
+    // Should still have Safe Chain CA
+    assert.match(contents, /-----BEGIN CERTIFICATE-----/, "Should contain Safe Chain CA");
+  });
+
+  it("ignores invalid PEM user cert", async () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "certtest-"));
+    
+    const safeChainPath = path.join(tmpDir, "safechain.pem");
+    fs.writeFileSync(safeChainPath, getValidCert(), "utf8");
+
+    const userCertPath = path.join(tmpDir, "invalid.pem");
+    fs.writeFileSync(userCertPath, "NOT A VALID PEM", "utf8");
+    process.env.NODE_EXTRA_CA_CERTS = userCertPath;
+
+    mock.module("./certUtils.js", {
+      namedExports: {
+        getCaCertPath: () => safeChainPath,
+      },
+    });
+
+    const { getCombinedCaBundlePath } = await import("./certBundle.js");
+    const bundlePath = getCombinedCaBundlePath();
+
+    assert.ok(fs.existsSync(bundlePath), "Bundle path should exist");
+    const contents = fs.readFileSync(bundlePath, "utf8");
+    // Should still have Safe Chain CA only
+    assert.match(contents, /-----BEGIN CERTIFICATE-----/, "Should contain Safe Chain CA");
+    assert.ok(!contents.includes("NOT A VALID"), "Should not include invalid cert");
+  });
+
+  it("rejects user cert with path traversal attempts", async () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "certtest-"));
+    const safeChainPath = path.join(tmpDir, "safechain.pem");
+    fs.writeFileSync(safeChainPath, getValidCert(), "utf8");
+
+    mock.module("./certUtils.js", {
+      namedExports: {
+        getCaCertPath: () => safeChainPath,
+      },
+    });
+
+    const { getCombinedCaBundlePath } = await import("./certBundle.js");
+    process.env.NODE_EXTRA_CA_CERTS = "../../../etc/passwd";
+    const bundlePath = getCombinedCaBundlePath();
+
+    assert.ok(fs.existsSync(bundlePath), "Bundle path should exist");
+    const contents = fs.readFileSync(bundlePath, "utf8");
+    // Should only have Safe Chain CA, rejected the traversal path
+    assert.match(contents, /-----BEGIN CERTIFICATE-----/, "Should contain Safe Chain CA");
+  });
+
+  it("rejects user cert with symlink", async () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "certtest-"));
+    
+    const safeChainPath = path.join(tmpDir, "safechain.pem");
+    fs.writeFileSync(safeChainPath, getValidCert(), "utf8");
+
+    // Create a target file and a symlink to it
+    const targetCert = path.join(tmpDir, "target.pem");
+    fs.writeFileSync(targetCert, getValidCert(), "utf8");
+    
+    const symlinkPath = path.join(tmpDir, "symlink.pem");
+    try {
+      fs.symlinkSync(targetCert, symlinkPath);
+    } catch {
+      // Skip test if symlinks are not supported (e.g., on Windows without admin)
+      return;
+    }
+
+    mock.module("./certUtils.js", {
+      namedExports: {
+        getCaCertPath: () => safeChainPath,
+      },
+    });
+
+    const { getCombinedCaBundlePath } = await import("./certBundle.js");
+    process.env.NODE_EXTRA_CA_CERTS = symlinkPath;
+    const bundlePath = getCombinedCaBundlePath();
+
+    assert.ok(fs.existsSync(bundlePath), "Bundle path should exist");
+    const contents = fs.readFileSync(bundlePath, "utf8");
+    // Should only have Safe Chain CA, symlinks are rejected
+    assert.match(contents, /-----BEGIN CERTIFICATE-----/, "Should contain Safe Chain CA");
+  });
+
+  it("rejects user cert that is a directory", async () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "certtest-"));
+    
+    const safeChainPath = path.join(tmpDir, "safechain.pem");
+    fs.writeFileSync(safeChainPath, getValidCert(), "utf8");
+
+    const certDir = path.join(tmpDir, "certs");
+    fs.mkdirSync(certDir);
+
+    mock.module("./certUtils.js", {
+      namedExports: {
+        getCaCertPath: () => safeChainPath,
+      },
+    });
+
+    const { getCombinedCaBundlePath } = await import("./certBundle.js");
+    process.env.NODE_EXTRA_CA_CERTS = certDir;
+    const bundlePath = getCombinedCaBundlePath();
+
+    assert.ok(fs.existsSync(bundlePath), "Bundle path should exist");
+    const contents = fs.readFileSync(bundlePath, "utf8");
+    // Should only have Safe Chain CA
+    assert.match(contents, /-----BEGIN CERTIFICATE-----/, "Should contain Safe Chain CA");
+  });
+
+  it("handles empty string user cert path", async () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "certtest-"));
+    const safeChainPath = path.join(tmpDir, "safechain.pem");
+    fs.writeFileSync(safeChainPath, getValidCert(), "utf8");
+
+    mock.module("./certUtils.js", {
+      namedExports: {
+        getCaCertPath: () => safeChainPath,
+      },
+    });
+
+    const { getCombinedCaBundlePath } = await import("./certBundle.js");
+    process.env.NODE_EXTRA_CA_CERTS = "   ";
+    const bundlePath = getCombinedCaBundlePath();
+
+    assert.ok(fs.existsSync(bundlePath), "Bundle path should exist");
+    const contents = fs.readFileSync(bundlePath, "utf8");
+    assert.match(contents, /-----BEGIN CERTIFICATE-----/, "Should contain Safe Chain CA");
+  });
+
+  it("accepts files with CRLF line endings (Windows-style)", async () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "certtest-"));
+    const safeChainPath = path.join(tmpDir, "safechain.pem");
+    fs.writeFileSync(safeChainPath, getValidCert(), "utf8");
+
+    // Create a real file with CRLF content to test Windows line ending support
+    const userCertPath = path.join(tmpDir, "user-cert-crlf.pem");
+    const userCert = getValidCert();
+    const certWithCRLF = userCert.replace(/\n/g, "\r\n");
+    fs.writeFileSync(userCertPath, certWithCRLF, "utf8");
+    process.env.NODE_EXTRA_CA_CERTS = userCertPath;
+
+    mock.module("./certUtils.js", {
+      namedExports: {
+        getCaCertPath: () => safeChainPath,
+      },
+    });
+
+    const { getCombinedCaBundlePath } = await import("./certBundle.js");
+    const bundlePath = getCombinedCaBundlePath();
+    assert.ok(fs.existsSync(bundlePath), "Bundle path should exist");
+    const contents = fs.readFileSync(bundlePath, "utf8");
+    const certCount = (contents.match(/-----BEGIN CERTIFICATE-----/g) || []).length;
+    assert.ok(certCount >= 2, "Bundle should contain Safe Chain and user certificates with CRLF");
+  });
+
+  it("detects and handles Windows-style path syntax (drive letters and UNC)", async () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "certtest-"));
+    const safeChainPath = path.join(tmpDir, "safechain.pem");
+    fs.writeFileSync(safeChainPath, getValidCert(), "utf8");
+
+    mock.module("./certUtils.js", {
+      namedExports: {
+        getCaCertPath: () => safeChainPath,
+      },
+    });
+
+    const { getCombinedCaBundlePath } = await import("./certBundle.js");
+    
+    // Test that Windows path syntax is recognized (even if files don't exist on macOS/Linux)
+    // These should gracefully fail (return Safe Chain CA only) rather than crash
+    const winPaths = [
+      "C:\\temp\\cert.pem",
+      "D:\\Users\\name\\certs\\ca.pem",
+      "\\\\server\\share\\cert.pem"
+    ];
+    
+    for (const winPath of winPaths) {
+      process.env.NODE_EXTRA_CA_CERTS = winPath;
+      const bundlePath = getCombinedCaBundlePath();
+      assert.ok(fs.existsSync(bundlePath), `Bundle should exist for ${winPath}`);
+      const contents = fs.readFileSync(bundlePath, "utf8");
+      assert.match(contents, /-----BEGIN CERTIFICATE-----/, "Should contain Safe Chain CA");
+    }
+  });
+
+  it("rejects path traversal with Windows-style paths (C:\\temp\\..\\etc\\passwd)", async () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "certtest-"));
+    const safeChainPath = path.join(tmpDir, "safechain.pem");
+    fs.writeFileSync(safeChainPath, getValidCert(), "utf8");
+
+    mock.module("./certUtils.js", {
+      namedExports: {
+        getCaCertPath: () => safeChainPath,
+      },
+    });
+
+    const { getCombinedCaBundlePath } = await import("./certBundle.js");
+    
+    // Test various Windows-style traversal attempts
+    const traversalPaths = [
+      "C:\\temp\\..\\etc\\passwd",
+      "D:\\Users\\..\\..\\Windows\\System32",
+      "\\\\server\\share\\..\\admin",
+      "../../../etc/passwd",  // Unix-style for comparison
+    ];
+    
+    // First, get baseline bundle without user certs to know expected cert count
+    delete process.env.NODE_EXTRA_CA_CERTS;
+    const baselineBundlePath = getCombinedCaBundlePath();
+    const baselineContents = fs.readFileSync(baselineBundlePath, "utf8");
+    const baselineCertCount = (baselineContents.match(/-----BEGIN CERTIFICATE-----/g) || []).length;
+    
+    for (const badPath of traversalPaths) {
+      process.env.NODE_EXTRA_CA_CERTS = badPath;
+      const bundlePath = getCombinedCaBundlePath();
+      assert.ok(fs.existsSync(bundlePath), "Bundle path should exist");
+      const contents = fs.readFileSync(bundlePath, "utf8");
+      // Should contain base bundle (Safe Chain + Mozilla + Node roots) but NOT user cert
+      const certCount = (contents.match(/-----BEGIN CERTIFICATE-----/g) || []).length;
+      assert.strictEqual(certCount, baselineCertCount, `Traversal path ${badPath} should be rejected; base bundle only (no user cert added)`);
+    }
+  });
+});

packages/safe-chain/src/registryProxy/interceptors/npm/npmInterceptor.js

@@ -1,4 +1,7 @@
-import { skipMinimumPackageAge } from "../../../config/settings.js";
+import {
+  getNpmCustomRegistries,
+  skipMinimumPackageAge,
+} from "../../../config/settings.js";
 import { isMalwarePackage } from "../../../scanning/audit/index.js";
 import { interceptRequests } from "../interceptorBuilder.js";
 import {
@@ -8,14 +11,20 @@ import {
 } from "./modifyNpmInfo.js";
 import { parseNpmPackageUrl } from "./parseNpmPackageUrl.js";
 
-const knownJsRegistries = ["registry.npmjs.org", "registry.yarnpkg.com"];
+const knownJsRegistries = [
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "registry.npmjs.com",
+];
 
 /**
  * @param {string} url
  * @returns {import("../interceptorBuilder.js").Interceptor | undefined}
  */
 export function npmInterceptorForUrl(url) {
-  const registry = knownJsRegistries.find((reg) => url.includes(reg));
+  const registry = [...knownJsRegistries, ...getNpmCustomRegistries()].find(
+    (reg) => url.includes(reg)
+  );
 
   if (registry) {
     return buildNpmInterceptor(registry);

packages/safe-chain/src/registryProxy/interceptors/npm/npmInterceptor.minPackageAge.spec.js

@@ -9,6 +9,7 @@ describe("npmInterceptor minimum package age", async () => {
     namedExports: {
       getMinimumPackageAgeHours: () => minimumPackageAgeSettings,
       skipMinimumPackageAge: () => skipMinimumPackageAgeSetting,
+      getNpmCustomRegistries: () => [],
     },
   });
 

packages/safe-chain/src/registryProxy/interceptors/npm/npmInterceptor.packageDownload.spec.js

@@ -1,19 +1,36 @@
 import { describe, it, mock } from "node:test";
 import assert from "node:assert";
 
-describe("npmInterceptor", async () => {
-  let lastPackage;
-  let malwareResponse = false;
+let lastPackage;
+let malwareResponse = false;
+let customRegistries = [];
 
-  mock.module("../../../scanning/audit/index.js", {
-    namedExports: {
-      isMalwarePackage: async (packageName, version) => {
-        lastPackage = { packageName, version };
-        return malwareResponse;
-      },
+mock.module("../../../scanning/audit/index.js", {
+  namedExports: {
+    isMalwarePackage: async (packageName, version) => {
+      lastPackage = { packageName, version };
+      return malwareResponse;
     },
-  });
+  },
+});
 
+mock.module("../../../config/settings.js", {
+  namedExports: {
+    LOGGING_SILENT: "silent",
+    LOGGING_NORMAL: "normal",
+    LOGGING_VERBOSE: "verbose",
+    ECOSYSTEM_JS: "js",
+    ECOSYSTEM_PY: "py",
+    getLoggingLevel: () => "normal",
+    getEcoSystem: () => "js",
+    setEcoSystem: () => {},
+    getMinimumPackageAgeHours: () => 24,
+    getNpmCustomRegistries: () => customRegistries,
+    skipMinimumPackageAge: () => false,
+  },
+});
+
+describe("npmInterceptor", async () => {
   const { npmInterceptorForUrl } = await import("./npmInterceptor.js");
 
   const parserCases = [
@@ -161,3 +178,90 @@ describe("npmInterceptor", async () => {
     );
   });
 });
+
+describe("npmInterceptor with custom registries", async () => {
+  const { npmInterceptorForUrl } = await import("./npmInterceptor.js");
+
+  it("should create interceptor for custom registry", async () => {
+    // Set custom registries for this test
+    customRegistries = ["npm.company.com", "registry.internal.net"];
+    const url = "https://npm.company.com/lodash/-/lodash-4.17.21.tgz";
+
+    const interceptor = npmInterceptorForUrl(url);
+
+    assert.ok(interceptor, "Interceptor should be created for custom registry");
+
+    await interceptor.handleRequest(url);
+
+    assert.deepEqual(lastPackage, {
+      packageName: "lodash",
+      version: "4.17.21",
+    });
+  });
+
+  it("should create interceptor for custom registry with scoped packages", async () => {
+    // Set custom registries for this test
+    customRegistries = ["npm.company.com", "registry.internal.net"];
+    malwareResponse = false;
+
+    const url =
+      "https://registry.internal.net/@company/package/-/package-1.0.0.tgz";
+
+    const interceptor = npmInterceptorForUrl(url);
+
+    assert.ok(
+      interceptor,
+      "Interceptor should be created for custom registry with scoped package"
+    );
+
+    await interceptor.handleRequest(url);
+
+    assert.deepEqual(lastPackage, {
+      packageName: "@company/package",
+      version: "1.0.0",
+    });
+  });
+
+  it("should handle multiple custom registries", async () => {
+    // Set custom registries for this test
+    customRegistries = ["npm.company.com", "registry.internal.net"];
+    malwareResponse = false;
+
+    const url1 = "https://npm.company.com/lodash/-/lodash-4.17.21.tgz";
+    const url2 = "https://registry.internal.net/express/-/express-4.18.2.tgz";
+
+    const interceptor1 = npmInterceptorForUrl(url1);
+    const interceptor2 = npmInterceptorForUrl(url2);
+
+    assert.ok(interceptor1, "Should create interceptor for first registry");
+    assert.ok(interceptor2, "Should create interceptor for second registry");
+
+    await interceptor1.handleRequest(url1);
+    assert.deepEqual(lastPackage, {
+      packageName: "lodash",
+      version: "4.17.21",
+    });
+
+    await interceptor2.handleRequest(url2);
+    assert.deepEqual(lastPackage, {
+      packageName: "express",
+      version: "4.18.2",
+    });
+  });
+
+  it("should not create interceptor for non-custom registry", () => {
+    // Set custom registries for this test
+    customRegistries = ["npm.company.com", "registry.internal.net"];
+    malwareResponse = false;
+
+    const url = "https://unknown.registry.com/package/-/package-1.0.0.tgz";
+
+    const interceptor = npmInterceptorForUrl(url);
+
+    assert.equal(
+      interceptor,
+      undefined,
+      "Should not create interceptor for unknown registry"
+    );
+  });
+});

packages/safe-chain/src/registryProxy/registryProxy.connect-tunnel.spec.js

@@ -182,13 +182,13 @@ describe("registryProxy.connectTunnel", () => {
 
       const duration = Date.now() - startTime;
 
-      // Should return 502 Bad Gateway
+      // Should return 504 Gateway Timeout (not 502 - 504 is for actual timeouts)
       assert.ok(
-        responseData.includes("HTTP/1.1 502 Bad Gateway"),
-        "Should return 502 for timeout"
+        responseData.includes("HTTP/1.1 504 Gateway Timeout"),
+        "Should return 504 for timeout"
       );
 
-      // Should timeout around 3 seconds for IMDS endpoints (allow some margin)
+      // Should timeout around 100ms for IMDS endpoints (allow some margin)
       assert.ok(
         duration >= 80 && duration < 200,
         `IMDS timeout should be ~80-200ms, got ${duration}ms`
@@ -280,10 +280,10 @@ describe("registryProxy.connectTunnel", () => {
 
       const duration = Date.now() - startTime;
 
-      // Should return 502 Bad Gateway (timeout)
+      // Should return 504 Gateway Timeout (not 502 - 504 is for actual timeouts)
       assert.ok(
-        responseData.includes("HTTP/1.1 502 Bad Gateway"),
-        "Should return 502 for timeout"
+        responseData.includes("HTTP/1.1 504 Gateway Timeout"),
+        "Should return 504 for timeout"
       );
 
       // Should NOT be instant - it should retry the connection (taking ~500ms due to mock timeout)

packages/safe-chain/src/registryProxy/registryProxy.js

@@ -2,7 +2,7 @@ import * as http from "http";
 import { tunnelRequest } from "./tunnelRequestHandler.js";
 import { mitmConnect } from "./mitmRequestHandler.js";
 import { handleHttpProxyRequest } from "./plainHttpProxy.js";
-import { getCaCertPath } from "./certUtils.js";
+import { getCombinedCaBundlePath } from "./certBundle.js";
 import { ui } from "../environment/userInteraction.js";
 import chalk from "chalk";
 import { createInterceptorForUrl } from "./interceptors/createInterceptorForEcoSystem.js";
@@ -37,10 +37,12 @@ function getSafeChainProxyEnvironmentVariables() {
   }
 
   const proxyUrl = `http://localhost:${state.port}`;
+  const caCertPath = getCombinedCaBundlePath();
+
   return {
     HTTPS_PROXY: proxyUrl,
     GLOBAL_AGENT_HTTP_PROXY: proxyUrl,
-    NODE_EXTRA_CA_CERTS: getCaCertPath(),
+    NODE_EXTRA_CA_CERTS: caCertPath,
   };
 }
 

packages/safe-chain/src/registryProxy/tunnelRequestHandler.js

@@ -43,6 +43,7 @@ export function tunnelRequest(req, clientSocket, head) {
 function tunnelRequestToDestination(req, clientSocket, head) {
   const { port, hostname } = new URL(`http://${req.url}`);
   const isImds = isImdsEndpoint(hostname);
+  const targetPort = Number.parseInt(port) || 443;
 
   if (timedoutImdsEndpoints.includes(hostname)) {
     clientSocket.end("HTTP/1.1 502 Bad Gateway\r\n\r\n");
@@ -58,64 +59,77 @@ function tunnelRequestToDestination(req, clientSocket, head) {
     return;
   }
 
-  const serverSocket = net.connect(
-    Number.parseInt(port) || 443,
-    hostname,
-    () => {
-      clientSocket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
-      serverSocket.write(head);
-      serverSocket.pipe(clientSocket);
-      clientSocket.pipe(serverSocket);
-    }
-  );
-
-  // Set explicit connection timeout to avoid waiting for OS default (~2 minutes).
-  // IMDS endpoints get shorter timeout (3s) since they're commonly unreachable outside cloud environments.
   const connectTimeout = getConnectTimeout(hostname);
-  serverSocket.setTimeout(connectTimeout);
 
-  serverSocket.on("timeout", () => {
-    // Suppress error logging for IMDS endpoints - timeouts are expected when not in cloud
+  // Use JS setTimeout for true connection timeout (not idle timeout).
+  // socket.setTimeout() measures inactivity, not time since connection attempt.
+  const connectTimer = setTimeout(() => {
     if (isImds) {
       timedoutImdsEndpoints.push(hostname);
       ui.writeVerbose(
-        `Safe-chain: connect to ${hostname}:${
-          port || 443
-        } timed out after ${connectTimeout}ms`
+        `Safe-chain: connect to ${hostname}:${targetPort} timed out after ${connectTimeout}ms`
       );
     } else {
       ui.writeError(
-        `Safe-chain: connect to ${hostname}:${
-          port || 443
-        } timed out after ${connectTimeout}ms`
+        `Safe-chain: connect to ${hostname}:${targetPort} timed out after ${connectTimeout}ms`
       );
     }
-    serverSocket.destroy(); // Clean up socket to prevent event loop hanging
-    clientSocket.end("HTTP/1.1 502 Bad Gateway\r\n\r\n");
+    serverSocket.destroy();
+    if (clientSocket.writable) {
+      clientSocket.end("HTTP/1.1 504 Gateway Timeout\r\n\r\n");
+    }
+  }, connectTimeout);
+
+  const serverSocket = net.connect(targetPort, hostname, () => {
+    // Clear timer to prevent false timeout errors after successful connection
+    clearTimeout(connectTimer);
+
+    clientSocket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+    serverSocket.write(head);
+    serverSocket.pipe(clientSocket);
+    clientSocket.pipe(serverSocket);
   });
 
   clientSocket.on("error", () => {
     // This can happen if the client TCP socket sends RST instead of FIN.
     // Not subscribing to 'error' event will cause node to throw and crash.
+    clearTimeout(connectTimer);
+    if (serverSocket.writable) {
+      serverSocket.end();
+    }
+  });
+
+  clientSocket.on("close", () => {
+    // Client closed connection - clean up server socket
+    clearTimeout(connectTimer);
     if (serverSocket.writable) {
       serverSocket.end();
     }
   });
 
   serverSocket.on("error", (err) => {
+    clearTimeout(connectTimer);
     if (isImds) {
       ui.writeVerbose(
-        `Safe-chain: error connecting to ${hostname}:${port} - ${err.message}`
+        `Safe-chain: error connecting to ${hostname}:${targetPort} - ${err.message}`
       );
     } else {
       ui.writeError(
-        `Safe-chain: error connecting to ${hostname}:${port} - ${err.message}`
+        `Safe-chain: error connecting to ${hostname}:${targetPort} - ${err.message}`
       );
     }
     if (clientSocket.writable) {
       clientSocket.end("HTTP/1.1 502 Bad Gateway\r\n\r\n");
     }
   });
+
+  serverSocket.on("close", () => {
+    // Server closed connection - clean up client socket
+    clearTimeout(connectTimer);
+    if (clientSocket.writable) {
+      clientSocket.end();
+    }
+  });
 }
 
 /**