Skip to content

fix(npm): verify unscoped alias before skip#91

Open
BunsDev wants to merge 1 commit into
mainfrom
codex/fix-unverified-npm-alias-vulnerability
Open

fix(npm): verify unscoped alias before skip#91
BunsDev wants to merge 1 commit into
mainfrom
codex/fix-unverified-npm-alias-vulnerability

Conversation

@BunsDev

@BunsDev BunsDev commented Jun 15, 2026

Copy link
Copy Markdown
Member

Motivation

  • The publish workflow previously skipped publishing the unscoped coven-code package when that exact version already existed on npm without verifying ownership or package contents, which can enable an attacker-controlled package to be mistaken for the official one.
  • Documentation and user-facing messages promoted the unscoped alias, increasing risk if the name is squatted.

Description

  • Added a published_package_matches_local helper in .github/workflows/npm-publish.yml that npm packs the local package and the remote package version, unpacks both tarballs, and diffs their contents before deciding to skip publishing the unscoped alias.
  • The workflow now only silently skips the scoped @opencoven/coven-code package; for the unscoped coven-code the job will skip only when the remote package contents match the locally prepared package and will exit 1 when contents do not match.
  • Updated user-facing install/one-shot instructions in README.md, docs/installation.md, and docs/src/content/installation.js to prefer the scoped @opencoven/coven-code package for installs and npx/bunx.
  • Updated npm/bin/coven-code to instruct users to reinstall from the scoped @opencoven/coven-code package when the native binary is missing.

Testing

  • Ran node scripts/prepare-npm-package.test.mjs and it completed successfully.
  • Performed a syntax check of the generated publish step with bash -n /tmp/npm-publish-step.sh and it reported no syntax errors.
  • Ran repository checks with git diff --check and git status and found no whitespace or diff errors.

Codex Task

Copilot AI review requested due to automatic review settings June 15, 2026 13:22
@vercel

vercel Bot commented Jun 15, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
docs Ready Ready Preview Jun 15, 2026 1:22pm

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Hardens the npm publish workflow to prevent silently skipping publication of the unscoped coven-code alias when a matching version already exists on npm but may not be the official package, and updates docs/messaging to prefer the scoped package.

Changes:

  • Add a workflow helper that compares local vs remote package tarball contents before skipping the unscoped alias publish.
  • Prefer @opencoven/coven-code in README and installation docs (including npx/bunx examples).
  • Update the CLI wrapper error message to recommend reinstalling the scoped package.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file
File Description
.github/workflows/npm-publish.yml Adds tarball diff verification to avoid unsafe skip of unscoped alias publish.
npm/bin/coven-code Updates reinstall guidance to prefer the scoped package.
README.md Updates install / one-shot commands to use scoped package.
docs/installation.md Updates installation examples to prefer scoped package.
docs/src/content/installation.js Updates rendered installation snippets to prefer scoped package.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +254 to +270
published_package_matches_local() {
local package_name="$1"
local tmp_dir local_dir remote_dir
tmp_dir="$(mktemp -d)"
local_dir="$tmp_dir/local"
remote_dir="$tmp_dir/remote"
mkdir -p "$local_dir" "$remote_dir"

(cd npm && npm pack --pack-destination "$local_dir" >/dev/null)
npm pack "${package_name}@${VERSION}" --pack-destination "$remote_dir" >/dev/null

mkdir -p "$tmp_dir/local-unpacked" "$tmp_dir/remote-unpacked"
tar -xzf "$(find "$local_dir" -name '*.tgz' -print -quit)" -C "$tmp_dir/local-unpacked"
tar -xzf "$(find "$remote_dir" -name '*.tgz' -print -quit)" -C "$tmp_dir/remote-unpacked"

diff -qr "$tmp_dir/local-unpacked/package" "$tmp_dir/remote-unpacked/package" >/dev/null
}
Comment on lines +281 to +287
if published_package_matches_local "$package_name"; then
echo "${package_name}@${VERSION} is already published with the expected package contents; skipping."
continue
fi

echo "::error::${package_name}@${VERSION} already exists on npm with unexpected package contents."
exit 1
Comment on lines +266 to +267
tar -xzf "$(find "$local_dir" -name '*.tgz' -print -quit)" -C "$tmp_dir/local-unpacked"
tar -xzf "$(find "$remote_dir" -name '*.tgz' -print -quit)" -C "$tmp_dir/remote-unpacked"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants