Giter Club home page Giter Club logo

verdaccio-audit's Introduction

Deprecated repository

This repository has been moved to a monorepo you can find in verdaccio/monorepo. This package is located in plugins/audit folder


verdaccio-audit

🛡🔬 npmjs audit support for verdaccio

verdaccio (latest) Known Vulnerabilities backers discord MIT node

Requirements

 npm install --global verdaccio-audit

Usage

To enable it you need to add this to your configuration file.

middlewares:
  audit:
    enabled: true
    strict_ssl: true # optional, defaults to true

Strict SSL

In some scenarios it may be necessary to disable SSL certificate validation. Setting strict_ssl to false will disable these checks, but will make all connections passing through this plugin inherently insecure.

Disclaimer

This plugin is experimental and unstable. Please report any issue you found.

License

MIT (http://www.opensource.org/licenses/mit-license.php)

verdaccio-audit's People

Contributors

ayusharma avatar dependabot[bot] avatar dfrencham avatar hangxingliu avatar juanpicado avatar paulbrimicombe avatar redi-wadash avatar sergiohgz avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

verdaccio-audit's Issues

It ignores http_proxy and https_proxy

We have setup like this:

https_proxy: http://address-of-proxy/

middlewares:
  audit:
    enabled: true

But it looks like audit doesn't use the proxy, hanging the request.

How to install plugin into docker container

Hi. I'm trying to install this plugin inside docker container based on verdaccio.

FROM verdaccio/verdaccio:latest
USER verdaccio
WORKDIR /verdaccio
COPY . .
# This will fail with EACCESS error
RUN npm i -g verdaccio-audit
EXPOSE 4873
VOLUME ["/verdaccio"]

npm i -g fails with EACCESS error
Installing into app directory (npm i --prefix /usr/local/app) will break dependencies and verdaccio will not start
Installing into plugins directory also is tricky because it will need to build this module, cause it uses flow.

Is there any easy way to do that. Without using docker compose and so on.

Audit requests always pass

Versions:

  • verdaccio-audit 0.2.0
  • npm 6.4.1
  • verdaccio 3.8.4

Install a package with vulnerabilities and audit:

npm --registry=my-verdaccio-host:123 install lodash@3
npm --registry=my-verdaccio-host:123 audit
  • Expected outcome -- one security vulnerability reported.
  • Actual outcome -- no security vulnerabilities.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.