milliways-infosec/AikidoSec-safe-chain
7
0
Fork 0
mirror of https://github.com/AikidoSec/safe-chain.git synced 2026-05-26 12:10:49 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Only write to stdout when safe-chain audited packages

Browse source
This commit is contained in:
Sander Declerck 2025-11-05 12:01:08 +01:00
parent 18f30ac66e
commit e4c40330f7
No known key found for this signature in database
3 changed files with 225 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

27
packages/safe-chain/src/scanning/audit/index.js
View file

@ -18,6 +18,29 @@ import {
* @property {boolean} isAllowed
*/
/**
* @typedef {Object} AuditStats
* @property {number} verifiedPackages
* @property {number} safePackages
* @property {number} malwarePackages
*/
/**
* @type AuditStats
*/
const auditStats = {
verifiedPackages: 0,
safePackages: 0,
malwarePackages: 0,
};
/**
* @returns {AuditStats}
*/
export function getAuditStats() {
return auditStats;
}
/**
* @param {PackageChange[]} changes
*
@ -41,16 +64,20 @@ export async function auditChanges(changes) {
);
if (malwarePackage) {
auditStats.malwarePackages += 1;
ui.writeVerbose(
`Safe-chain: Package ${change.name}@${change.version} is marked as malware: ${malwarePackage.status}`
);
disallowedChanges.push({ ...change, reason: malwarePackage.status });
} else {
auditStats.safePackages += 1;
ui.writeVerbose(
`Safe-chain: Package ${change.name}@${change.version} is clean`
);
allowedChanges.push(change);
}
auditStats.verifiedPackages += 1;
}
const auditResults = {