minimal implementation for pmg

cmd/ecosystems/npm.go

@@ -1,15 +1,18 @@
 package ecosystems
 
 import (
+	"context"
 	_ "embed"
 	"fmt"
 	"os"
 	"strings"
+	"time"
 
 	packagev1 "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/messages/package/v1"
 	"github.com/safedep/dry/log"
 	"github.com/safedep/pmg/pkg/analyser"
 	"github.com/safedep/pmg/pkg/common"
+	"github.com/safedep/pmg/pkg/common/utils"
 	"github.com/spf13/cobra"
 )
 
@@ -23,25 +26,45 @@ var arboristJs string
 
 func NewNpmCommand() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:   "npm",
+		Use:   "npm [action] [package]",
 		Short: "Scan packages from npm registry",
+		Args:  cobra.MinimumNArgs(2),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			action = args[0]
 			packageName = args[1]
-			if action == "install" {
+
+			validActions := map[string]bool{"install": true, "i": true, "add": true}
+			if validActions[action] {
 				err := wrapNpm()
 				if err != nil {
-					// TODO
-					log.Fatalf("wrapNpm: ", err.Error())
+					log.Errorf("Failed to wrap npm: %v", err)
+					return err
 				}
+				return nil
 			}
-			return nil
+
+			// For non-install actions, just pass through to npm
+			npmPath, err := utils.GetInterpreterPath("npm")
+			if err != nil {
+				return fmt.Errorf("npm not found: %w", err)
+			}
+
+			return utils.ExecCmd(npmPath, args)
 		},
 	}
 	return cmd
 }
 
 func wrapNpm() error {
+	if packageName == "" {
+		return fmt.Errorf("package name cannot be empty")
+	}
+
+	// Setup context with timeout for API calls
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute)
+	defer cancel()
+
+	// Extract package information
 	outputFile, err := common.RunPkgExtractor(common.ExtractorOptions{
 		PackageName:   packageName,
 		ScriptContent: arboristJs,
@@ -50,56 +73,91 @@ func wrapNpm() error {
 		Args:          []string{},
 	})
 	if err != nil {
-		return err
+		return fmt.Errorf("failed to extract package info: %w", err)
 	}
+	// Clean up the temporary file when done
+	defer os.Remove(outputFile)
 
 	data, err := os.ReadFile(outputFile)
 	if err != nil {
-		return fmt.Errorf("Error while reading package output file: %s", err.Error())
+		return fmt.Errorf("error while reading package output file: %w", err)
 	}
 
-	lines := strings.SplitSeq(string(data), "\n")
-	for line := range lines {
+	maliciousPkgs := make(map[string]string)
+
+	client, err := analyser.GetMalwareAnalysisClient()
+	if err != nil {
+		return fmt.Errorf("error while creating a malware analysis client: %w", err)
+	}
+
+	lines := strings.Split(string(data), "\n")
+	for _, line := range lines {
 		line = strings.TrimSpace(line)
 		if line == "" || !strings.Contains(line, "@") {
 			continue
 		}
 
-		parts := strings.SplitN(line, "@", 2)
-		if len(parts) != 2 {
-			log.Debugf("Invalid package line:", line)
+		idx := strings.LastIndex(line, "@")
+		if idx <= 0 {
+			log.Debugf("Invalid package line: %s", line)
 			continue
 		}
 
-		name := parts[0]
-		version := parts[1]
+		name := line[:idx]
+		version := line[idx+1:]
 
-		client, err := analyser.GetMalwareAnalysisClient()
+		resp, err := analyser.SubmitPackageForAnalysis(ctx, client, packagev1.Ecosystem_ECOSYSTEM_NPM, name, version)
 		if err != nil {
-			return fmt.Errorf("Error while creating a malware analysis client: %s", err.Error())
-		}
-
-		resp, err := analyser.SubmitPackageForAnalysis(client, packagev1.Ecosystem_ECOSYSTEM_NPM, name, version)
-		if err != nil {
-			log.Debugf("Failed to analyze %s@%s: %v\n", name, version, err)
-			continue
-		}
-		log.Debugf("Submitted %s@%s | Analysis ID: %s\n", name, version, resp.GetAnalysisId())
-
-		reportResp, err := analyser.GetAnalysisReport(client, resp.GetAnalysisId())
-		if err != nil {
-			log.Debugf("Failed to get analysis report for %s:%s %v\n", name, resp.GetAnalysisId(), err)
+			log.Debugf("Failed to analyze %s@%s: %v", name, version, err)
 			continue
 		}
 
-		_ = reportResp.GetReport()
+		reportResp, err := analyser.GetAnalysisReport(ctx, client, resp.GetAnalysisId())
+		if err != nil {
+			log.Debugf("Failed to get analysis report for %s:%s %v", name, resp.GetAnalysisId(), err)
+			continue
+		}
+
+		report := reportResp.GetReport()
+		if report == nil {
+			log.Debugf("Empty report received for %s", name)
+			continue
+		}
+
+		inference := report.GetInference()
+		if inference == nil {
+			log.Debugf("No inference data for %s", name)
+			continue
+		}
+
+		log.Infof("Inference for %s: isMalware=%v", name, inference.GetIsMalware())
+
+		if inference.GetIsMalware() {
+			maliciousPkgs[line] = inference.GetSummary()
+		}
 	}
 
-	// TODO:
 	// Get the npm PATH
-	// Check if any vulnerable package exists?
-	// If yes - Confirm with user to continue or not
-	// If no - Install the pkg & return
-	// If continue - Install the pkg
+	npmPath, err := utils.GetInterpreterPath("npm")
+	if err != nil {
+		return fmt.Errorf("npm not found: %w", err)
+	}
+
+	// Check if any malicious package exists
+	if len(maliciousPkgs) > 0 {
+		if !utils.ConfirmInstallation(maliciousPkgs) {
+			log.Infof("Installation canceled due to security concerns")
+			return nil
+		}
+		log.Warnf("Continuing installation despite security warnings...")
+	}
+
+	// Install the package and return
+	cmdArgs := []string{action, packageName}
+	if err = utils.ExecCmd(npmPath, cmdArgs); err != nil {
+		return fmt.Errorf("failed to execute npm command: %w", err)
+	}
+
+	log.Infof("Successfully installed %s", packageName)
 	return nil
 }