vlt / docs

    • PricingBenchmarks (opens in new window)Community (opens in new window)Feedback
  • Overview
    • Overview
    • browser
    • index
    • Reference
    • update-expired
  • Classes
  • SecurityArchive
  • Interfaces
  • SecurityArchiveLike
  • Type Aliases
  • DBReadEntry
  • DBWriteEntry
  • JSONItemResponse
  • PackageAlert
  • PackageAlertProps
  • PackageReportData
  • PackageScore
  • SecurityArchiveOptions
  • SecurityArchiveRefreshOptions
  • Functions
  • asPackageReportData()
  • asSecurityArchiveLike()
  • getItemScore()
  • isPackageReportData()
  • isSecurityArchiveLike()
  • References
  • npmRegistryURL
  • usesNpmRegistry
  1. Client
  2. /
  3. API Reference
  4. /
  5. @vltpkg/security-archive
  6. /
  7. index

index

Classes

SecurityArchive

Defined in: src/security-archive/src/index.ts:85

A database of security information for given packages from a list of nodes.

Using the SecurityArchive.refresh() method will update the local cache with information from the socket.dev APIs or load from the local storage if available. Information about package security is then available using the SecurityArchive.get() method. Remote requests are bounded by the timeout option.

Extends

  • LRUCache<DepID, PackageReportData>

Implements

  • SecurityArchiveLike

Constructors

new SecurityArchive()
TypeScript
new SecurityArchive(options): SecurityArchive

Defined in: src/security-archive/src/index.ts:139

Parameters
ParameterType
optionsSecurityArchiveOptions
Returns

SecurityArchive

Overrides
TypeScript
LRUCache<DepID, PackageReportData>.constructor

Properties

PropertyTypeDefault valueDescription
okbooleanfalseTrue if the refresh process was successful and report data is available for all public registry packages from the initial list of nodes.
timedOutbooleanfalseTrue if the last refresh() timed out waiting for the remote API.

Accessors

defaultMax
Get Signature
TypeScript
get static defaultMax(): number

Defined in: src/security-archive/src/index.ts:121

By default, limits to 100K entries in the in-memory archive.

Returns

number

defaultTimeout
Get Signature
TypeScript
get static defaultTimeout(): number

Defined in: src/security-archive/src/index.ts:135

By default, remote requests time out after 30 seconds.

Returns

number

defaultTtl
Get Signature
TypeScript
get static defaultTtl(): number

Defined in: src/security-archive/src/index.ts:128

By default, entries are cached for 3 hours.

Returns

number

Methods

delete()
TypeScript
delete(k): boolean

Defined in: src/security-archive/src/index.ts:192

Delete the report data stored under the base DepID.

Parameters
ParameterType
kDepID
Returns

boolean

Implementation of

SecurityArchiveLike.delete

Overrides
TypeScript
LRUCache.delete
get()
TypeScript
get(k, options?): undefined | PackageReportData

Defined in: src/security-archive/src/index.ts:159

Get the report data for a node, keyed by its base DepID.

Parameters
ParameterType
kDepID
options?GetOptions<DepID, PackageReportData, unknown>
Returns

undefined | PackageReportData

Implementation of

SecurityArchiveLike.get

Overrides
TypeScript
LRUCache.get
has()
TypeScript
has(k): boolean

Defined in: src/security-archive/src/index.ts:171

Check for report data, keyed by the base DepID.

Parameters
ParameterType
kDepID
Returns

boolean

Implementation of

SecurityArchiveLike.has

Overrides
TypeScript
LRUCache.has
refresh()
TypeScript
refresh(__namedParameters): Promise<void>

Defined in: src/security-archive/src/index.ts:517

Starts the security archive by providing an array of NodeLike instances, its registry-based nodes are going to be used as valid potential entries.

Any entry that is missing from the persisted cached values are going to be requested in a batch-request to the remote socket.dev API.

Parameters
ParameterType
__namedParametersSecurityArchiveRefreshOptions
Returns

Promise<void>

set()
TypeScript
set(
   k, 
   v, 
   setOptions?): SecurityArchive

Defined in: src/security-archive/src/index.ts:179

Store report data for a node, keyed by its base DepID so peer-suffixed copies of the same package share one entry.

Parameters
ParameterType
kDepID
vPackageReportData
setOptions?SetOptions<DepID, PackageReportData, unknown>
Returns

SecurityArchive

Implementation of

SecurityArchiveLike.set

Overrides
TypeScript
LRUCache.set
toJSON()
TypeScript
toJSON(): Record<DepID, PackageReportData>

Defined in: src/security-archive/src/index.ts:572

Outputs the current in-memory cache as a JSON object.

Returns

Record<DepID, PackageReportData>

start()
TypeScript
static start(options): Promise<SecurityArchive>

Defined in: src/security-archive/src/index.ts:110

Creates a new security archive instance and starts the refresh process.

Parameters
ParameterType
optionsOptionsBase<DepID, PackageReportData, unknown> & object & SecurityArchiveRefreshOptions
Returns

Promise<SecurityArchive>

Interfaces

SecurityArchiveLike

Defined in: src/security-archive/src/types.ts:19

An interface for interacting with a security archive.

Properties

PropertyType
clear() => void
delete(depId: DepID) => void
get(depId: DepID) => undefined | PackageReportData
has(depId: DepID) => boolean
ok?boolean
set(depId: DepID, data: PackageReportData) => void

Type Aliases

DBReadEntry

TypeScript
type DBReadEntry = object;

Defined in: src/security-archive/src/index.ts:39

Type declaration

NameType
depIDstring
nownumber
reportstring
startnumber
ttlnumber

DBWriteEntry

TypeScript
type DBWriteEntry = [string, string, number, number];

Defined in: src/security-archive/src/index.ts:47

JSONItemResponse

TypeScript
type JSONItemResponse = object;

Defined in: src/security-archive/src/types.ts:143

A single line of the NDJSON stream returned by the socket.dev batch purl API. Besides package artifacts, the stream can carry purlError and summary wrapper items, and a package that was published recently enough to not have been analyzed yet comes back as an artifact with no score object at all.

Type declaration

NameType
_type?"purlError" | "summary"
name?string
namespace?`@${string}`
score?object
score.licensenumber
score.maintenancenumber
score.overall?number
score.qualitynumber
score.supplyChainnumber
score.vulnerabilitynumber
version?string

PackageAlert

TypeScript
type PackageAlert = object;

Defined in: src/security-archive/src/types.ts:60

A known alert for a given package.

Type declaration

NameType
categorystring
keystring
props?PackageAlertProps
severity"low" | "medium" | "high" | "critical"
typestring

PackageAlertProps

TypeScript
type PackageAlertProps = object;

Defined in: src/security-archive/src/types.ts:51

Package alert extra information.

Type declaration

NameType
cveId?`CVE-${string}`
cwes?object[]
lastPublishstring

PackageReportData

TypeScript
type PackageReportData = object;

Defined in: src/security-archive/src/types.ts:101

The report data for a given package.

Type declaration

NameType
alertsPackageAlert[]
authorstring[]
idstring
licensestring
namestring
namespace?`@${string}`
scorePackageScore
sizenumber
type"npm"
versionstring

PackageScore

TypeScript
type PackageScore = object;

Defined in: src/security-archive/src/types.ts:71

The scores for a given package

Type declaration

NameTypeDescription
licensenumberScore factors relating to package licensing (0-1)
maintenancenumberScore factors relating to package maintenance (0-1)
overallnumberThe average of all score factors. (0-1)
qualitynumberScore factors relating to code quality (0-1)
supplyChainnumberScore factors relating to supply chain security (0-1)
vulnerabilitynumberScore factors relating to package vulnerabilities (0-1)

SecurityArchiveOptions

TypeScript
type SecurityArchiveOptions = LRUCache.OptionsBase<DepID, PackageReportData, unknown> & object;

Defined in: src/security-archive/src/index.ts:49

Type declaration

NameTypeDescription
fetchMethod?undefinedSecurity archive does not supports a fetch-on-demand model.
path?stringAn optional value for the path in which to store the sqlite db.
retries?numberNumber of retries attempts to reach the remote security API.
timeout?numberMax ms to wait for the remote security API, incl. retries. Defaults to VLT_SECURITY_ARCHIVE_TIMEOUT env or SecurityArchive.defaultTimeout. Positive integers only, other values are ignored. On timeout, missing packages are left unscanned and a warning is printed.

SecurityArchiveRefreshOptions

TypeScript
type SecurityArchiveRefreshOptions = object;

Defined in: src/security-archive/src/types.ts:8

Parameter options for initializing a security archive.

Type declaration

NameTypeDescription
nodesNodeLike[]A @link{GraphLike} instance to find what packages the security archive should have.

Functions

asPackageReportData()

TypeScript
function asPackageReportData(o): PackageReportData

Defined in: src/security-archive/src/types.ts:127

Parameters

ParameterType
ounknown

Returns

PackageReportData

asSecurityArchiveLike()

TypeScript
function asSecurityArchiveLike(o): SecurityArchiveLike

Defined in: src/security-archive/src/types.ts:39

Parameters

ParameterType
ounknown

Returns

SecurityArchiveLike

getItemScore()

TypeScript
function getItemScore(data): undefined | PackageScore

Defined in: src/security-archive/src/types.ts:163

Returns the score of a response item with its overall value recalculated as the average of the individual components, or undefined when the item is not a scored package artifact.

Parameters

ParameterType
dataJSONItemResponse

Returns

undefined | PackageScore

isPackageReportData()

TypeScript
function isPackageReportData(o): o is PackageReportData

Defined in: src/security-archive/src/types.ts:114

Parameters

ParameterType
ounknown

Returns

o is PackageReportData

isSecurityArchiveLike()

TypeScript
function isSecurityArchiveLike(o): o is SecurityArchiveLike

Defined in: src/security-archive/src/types.ts:28

Parameters

ParameterType
ounknown

Returns

o is SecurityArchiveLike

References

npmRegistryURL

Re-exports npmRegistryURL

usesNpmRegistry

Re-exports usesNpmRegistry

PreviousbrowserNextReference

On this page

  • Classes
  • SecurityArchive
  • Interfaces
  • SecurityArchiveLike
  • Type Aliases
  • DBReadEntry
  • DBWriteEntry
  • JSONItemResponse
  • PackageAlert
  • PackageAlertProps
  • PackageReportData
  • PackageScore
  • SecurityArchiveOptions
  • SecurityArchiveRefreshOptions
  • Functions
  • asPackageReportData()
  • asSecurityArchiveLike()
  • getItemScore()
  • isPackageReportData()
  • isSecurityArchiveLike()
  • References
  • npmRegistryURL
  • usesNpmRegistry

Deploy your package on vlt.io

Publish scoped and private packages, manage organizations and access, and give every developer and CI environment a consistent source for public and private JavaScript dependencies.

Publish now