Restore SFW blocking tests after Socket API errors are fixed

Abierto
#161 0 comentarios 0 reacciones 1 asignado Ver en GitHub

@fengmk2 ya está trabajando en esto.

Desde el 16/9/2026.

Evaluación

Este issue todavía no se ha evaluado.

Descripción

Restore the SFW malicious-package blocking checks after the Socket alert API failure is resolved.

Upstream report: https://github.com/SocketDev/sfw-free/issues/65.

Temporary skip: #162.

On 2026-09-16, sfw vp install lodahs returned exit code 0 without a block message. This failed the Linux, macOS, and Windows jobs in test-sfw-blocks-malicious, plus the final blocking check in test-sfw-with-socketdev-action.

The failed CI run and retry used Vite+ 0.3.2. The same package and tool versions passed the blocking check on 2026-09-15.

Direct checks with SFW 1.15.1 and 1.15.2 report:

Error occurred: error while fetching package alerts
{"errors":["Malformed Socket API response (Invalid input)"],"purlStrings":["pkg:npm/lodahs@0.0.1-security"]}

The same error occurs with the alternatives crossenv, babelcli, mongose, axois, node-click, and webb3. SFW allows their security placeholder downloads. A benign control, is-odd@3.0.1, produces a normal packageAllowed event. These results indicate a failure in alert handling, so changing the test package does not resolve the failure.

To reproduce without executing package code, run this command with a fresh SFW process:

SFW_DEBUG=true sfw --verbose curl --fail --silent --show-error --max-time 25 \
  https://registry.npmjs.org/lodahs/-/lodahs-0.0.1-security.tgz \
  -o /dev/null

The temporary fix skips the test-sfw-blocks-malicious job and the final malicious-package assertion in test-sfw-with-socketdev-action. The other SFW setup and installation checks remain enabled.

Follow-up:

  • Confirm that SFW can fetch alerts and block a documented test package. Update the pinned SFW version if the upstream fix requires it.
  • Remove both temporary if: ${{ false }} conditions from .github/workflows/test.yml.
  • Confirm a nonzero exit and the package-specific block message on Linux, macOS, and Windows, and through socketdev/action.

Keep both assertions: a network error or registry 404 alone must not count as a successful SFW block.

Lenguaje dominante
TypeScript
Estrellas
110
Forks
22
Merge medio
1 d 5 h
PR fusionados (30 d)
31

Guía de contribución

Abrir la guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de voidzero-dev/setup-vp

Todos los issues de voidzero-dev/setup-vp

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.