Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Detect generic NPM auth #3712

Draft
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

rgmz
Copy link
Contributor

@rgmz rgmz commented Dec 2, 2024

Description:

This detects generic (non-standard) tokens for third-party registries (e.g., GitHub, Artifactory). The implementation is split from #2264.

It depends on #3705.

Future work

  • npm registry-auth-token test values
  • Whatever this is
    2024-12-02T14:56:22-05:00	info-0	trufflehog.npm	Testing potential registry	{"detector_worker_id": "sHn25", "detector": {"type":"NpmToken","version":3}, "timeout": 60, "link": "https://github.com/Samsung/lwnode/blob/edc407f9f8092e9661ba753aa6e3a5de2a5f268b/deps/npm/CHANGELOG.md#L1", "registry": "github.com/claudiahdz", "token": "documentation"}
    2024-12-02T14:56:23-05:00	info-0	trufflehog.npm	Testing potential registry	{"detector_worker_id": "sHn25", "detector": {"type":"NpmToken","version":3}, "timeout": 60, "link": "https://github.com/Samsung/lwnode/blob/edc407f9f8092e9661ba753aa6e3a5de2a5f268b/deps/npm/CHANGELOG.md#L1", "registry": "github.com/isaacs", "token": "documentation"}
    2024-12-02T14:56:24-05:00	info-0	trufflehog.npm	Testing potential registry	{"detector_worker_id": "sHn25", "detector": {"type":"NpmToken","version":3}, "timeout": 60, "link": "https://github.com/Samsung/lwnode/blob/edc407f9f8092e9661ba753aa6e3a5de2a5f268b/deps/npm/CHANGELOG.md#L1", "registry": "github.com/dmitrydvorkin", "token": "documentation"}
    2024-12-02T14:56:24-05:00	info-0	trufflehog.npm	Testing potential registry	{"detector_worker_id": "sHn25", "detector": {"type":"NpmToken","version":3}, "timeout": 60, "link": "https://github.com/Samsung/lwnode/blob/edc407f9f8092e9661ba753aa6e3a5de2a5f268b/deps/npm/CHANGELOG.md#L1", "registry": "www.youtube.com/watch", "token": "documentation"}
    
  • Other placeholders
    2024-12-04T12:35:28Z    info-0  trufflehog.npm  Testing potential registry      {"detector_worker_id": "EaTeU", "detector": {"type":"NpmToken","version":3}, "timeout": 60, "link": "https://github.com/ibm-developer-skills-network/cazgi-IBM-Watson-NLU-Project/blob/03caf5b0a904516dcf9c9e53d176b1ad505ef3e1/node_modules/npm/docs/content/configuring-npm/npmrc.md#L1"
    , "registry": "somewhere-else.com/myorg", "token": "MYTOKEN1"}
    2024-12-04T12:35:29Z    info-0  trufflehog.npm  Testing potential registry      {"detector_worker_id": "FHk5T", "detector": {"type":"NpmToken","version":3}, "timeout": 60, "link": "https://github.com/ibm-developer-skills-network/cazgi-IBM-Watson-NLU-Project/blob/03caf5b0a904516dcf9c9e53d176b1ad505ef3e1/node_modules/npm/man/man5/npmrc.5#L1", "registry": "somewh
    ere-else.com/another", "token": "MYTOKEN2"}
    2024-12-04T02:55:38Z    info-0  trufflehog.npm  Testing potential registry      {"detector_worker_id": "ZvhLg", "detector": {"type":"NpmToken","version":3}, "timeout": 60, "link": "https://github.com/IBM/nodejs-idb-connector/blob/4216b27e9f7f325d248d09e9b75334ef98f999a3/.github/Jenkinsfile#L1", "registry": "registry.npmjs.org", "token": "credentials('idb-conne
    ctor-npm-token"}
    
  • Environment variables / interpolation
    2024-12-02T21:47:40-05:00	info-0	trufflehog.npm	Testing potential registry	{"detector_worker_id": "JnwWf", "detector": {"type":"NpmToken","version":3}, "timeout": 60, "link": "https://github.com/Shopify/react-native-skia/blob/a0b329fef10617fb95cb9b8b748379049621e740/.yarn/cache/@expo-vector-icons-npm-13.0.0-744b56496b-a1df3b08e5.zip", "registry": "npm.fontawesome.com", "token": "${npm_token}"}
    

Checklist:

  • Tests passing (make test-community)?
  • Lint passing (make lint this requires golangci-lint)?

@rgmz rgmz force-pushed the feat/npm-generic-detector branch 3 times, most recently from c63eb2e to 71d86aa Compare December 2, 2024 15:41
@rgmz rgmz force-pushed the feat/npm-generic-detector branch from 71d86aa to bd22b5d Compare December 15, 2024 15:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

1 participant