search

hiqdev / asset-packagist

Asset Packagist
https://asset-packagist.org
BSD 3-Clause "New" or "Revised" License
247 stars 24 forks source link

Implement "composer audit" for NPM packages #159

Open prudloff-insite opened 10 months ago

prudloff-insite commented 10 months ago

It would be useful if composer audit could work for npm-asset/ packages. composer audit reads a security-advisories key in the JSON returned by the repository. Some other third-party Composer repositories have already implemented it (for example: https://repo.packagist.org/p2/drupal/core.json). It should be possible to call the the NPM audit API (https://registry.npmjs.org/-/npm/v1/security/audits) and convert the result to the Composer format when building the Composer repository.

(I created a Composer plugin that does this but as a separate command: https://github.com/prudloff-insite/composer-npm-audit)

SilverFire commented 10 months ago

Hello. Thank you for your idea! We don't have enough resources to implement this enhancement right away, but this repo is tagged with the hacktoberfest tag, so maybe someone would like to push this idea to the implementation.