5

I try using preinstall npm scripts, but it only run when I checkout the project into a new space, and run "npm i" standalone

I need a solution to run a script before the new dependency writed into package.json. It doesn't depend the type of dependency: dev or prod. All of them need to check.

For example, when a new developer join to the team, and want to add new dependency which has known vulnerability, this script stops the action before the package.json was changed, and show warning message for the developer

4 Answers 4

2
+25

There isn't a way to do that with npm scripts. So, unless you feel like implementing one you're going to have to adjust your process. Start by identifying all the problems you're trying to address with an on-dependency-install hook.

You give the example of preventing the installation of a dependency or dependency version. That's not a problem: it's a solution you've identified for the problem. Figure out what the actual problem is, and then reevaluate your solution to see if it's really the most appropriate measure to take.

Possibly (probably) you are afraid of vulnerable code making it up to production. That's a problem definition you can work with. What possible solutions exist? You've already identified the blacklist. But not only is that not supported by your tooling, even if it were the onus is then on you to keep the blacklist up to date. Given just how quickly the Node world moves, that's enough work to keep several people employed fulltime. And that's not even getting into deploying it to your developers.

The good news is that that's not the only solution: you could establish procedural safeguards against integrating vulnerable code. If you're using a distributed VCS like Git, pull requests are right there: disable pushing commits to the master or development branch, have developers work in feature branches and submit pull requests, then review those pull requests and screen any new dependencies for vulnerabilities when they show up. If you're using something like SVN, you can use feature branches with code reviews to similar effect. Your developers get extra eyes on their code looking for vulnerabilities, optimizations, edge cases, and so forth; you don't waste time screening dependencies that nobody ever tries to integrate. And nobody has to worry about getting the latest copy of the blacklist. For this particular scenario, everybody wins with a process solution over a technical solution.

If you have other reasons for wanting to fire scripts when dependencies are installed, try working back to the root of the problem the same way. The way Node dependency management and module interactions work, you'll probably discover it's preferable to develop better process habits.

2
  • Okay, I accept your opinion, my problem is a solution in fact. But the problem is node modules has a known vulnerabilities, and our team cannot give a warning when they start to use these modules. What you said git hook, or code review is too late, they already spend theirs time. But it better than nothing of course. My solution is the warning message and / or block the installing procedure of vulnerability. And the increased attention is work only for a few weeks (not long-term, sustainable), when the deadlines comes closer, the attention will decrease
    – sarkiroka
    Commented Oct 16, 2017 at 7:46
  • If you're that worried about it, document the forbidden dependencies. Get your developers to check the list when they add something. Have daily standups where your developers talk about what they're doing -- if you aren't, that's a good practice anyway -- and double-check then. But that list is not and will never be anywhere near complete, so going to extreme technical lengths to integrate it is past the point of diminishing returns. Minimize the potential time loss through process, don't waste your own time on tooling.
    – dmfay
    Commented Oct 16, 2017 at 14:43
2

If you are using git, you can use pre-commit/push hooks, the result is pretty much the same, no vulnerabilities in code base.

For exemple with husky and nsp you could do something like this :

{
  "scripts": {
    "prepush": "nsp check"
  }
}
4
  • Nice. It protect the code base, but the team member waste his time when his lib falling on nsp check. But the result is correct: vulnerability free code base.
    – sarkiroka
    Commented Oct 12, 2017 at 15:33
  • Yep. Maybe you can use eslint with this rule and make it part of your build/run command ? Commented Oct 12, 2017 at 15:46
  • How long will it be to maintain the ruleset? The modules changes and other version is maybe good enough, and after that reveals a new vulnerability, etc...
    – sarkiroka
    Commented Oct 16, 2017 at 7:49
  • 1
    Sure, but static checking must be much faster, you can try to add nsp to your run-in-dev script and see if it's worth it. Commented Oct 16, 2017 at 8:56
0

Riffing off Gabriel's suggestions, since you are concerned about devs wasting time when the lib they add fails an nsp check... You can use an editor extension to run the nsp check as they code. Then have Husky do a pre-commit nsp check as well.

I would also recommend Greenkeeper.io to prevent vulnerabilities before they are found.

0

If the main concern is that these vulnerable packages are being run within your network (since there's no way to prevent those devs from using those packages in general), you could mirror a subset of the npm registry that you consider safe, or manually add known safe dependencies to that mirror, and block access to the main registry https://registry.npmjs.org/ at the network level. This would mean your developers are stuck waiting for the mirror to be updated, but would require somebody to at least stop and think before they're able to install a problematic module.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.