verdaccio / verdaccio-audit Goto Github PK

Hi. I'm trying to install this plugin inside docker container based on verdaccio.

FROM verdaccio/verdaccio:latest
USER verdaccio
WORKDIR /verdaccio
COPY . .
# This will fail with EACCESS error
RUN npm i -g verdaccio-audit
EXPOSE 4873
VOLUME ["/verdaccio"]

npm i -g fails with EACCESS error
Installing into app directory (npm i --prefix /usr/local/app) will break dependencies and verdaccio will not start
Installing into plugins directory also is tricky because it will need to build this module, cause it uses flow.

Is there any easy way to do that. Without using docker compose and so on.

Implement -/npm/v1/security/audits/quick

http <-- 404, user: undefined(172.17.0.1), req: 'POST /-/npm/v1/security/audits/quick', bytes: 49822/170

refers to verdaccio/verdaccio#689

We have setup like this:

https_proxy: http://address-of-proxy/

middlewares:
  audit:
    enabled: true

But it looks like audit doesn't use the proxy, hanging the request.

Versions:

• verdaccio-audit 0.2.0
• npm 6.4.1
• verdaccio 3.8.4

Install a package with vulnerabilities and audit:

npm --registry=my-verdaccio-host:123 install lodash@3
npm --registry=my-verdaccio-host:123 audit

• Expected outcome -- one security vulnerability reported.
• Actual outcome -- no security vulnerabilities.