依存パッケージが乗っ取られていたとき

mkdir -p ~/lab/registry/debug/- && cd ~/lab
for v in 4.4.1 4.4.2 4.4.3; do
  mkdir -p src/$v
  echo 'module.exports = () => () => {};' > src/$v/index.js
  echo "{ \"name\": \"debug\", \"version\": \"$v\", \"main\": \"index.js\" }" > src/$v/package.json
done
# 4.4.2 にだけ、インストール時に動くスクリプトを持たせます
# おとりの鍵のファイルを開いて読むだけで、中身はどこにも送りません
cat > src/4.4.2/package.json <<'J'
{ "name": "debug", "version": "4.4.2", "main": "index.js",
  "scripts": { "postinstall": "node setup.js" } }
J
echo "try { require('fs').readFileSync('/root/.aws/credentials'); } catch (e) {}" > src/4.4.2/setup.js
for v in 4.4.1 4.4.2 4.4.3; do (cd src/$v && npm pack --silent --pack-destination ~/lab/registry/debug/-); done

cat > ~/lab/publish.py <<'P'
# レジストリに並べる版を決める(この VM の中だけ。外へは何も公開しません)
import base64, hashlib, json, os, sys, tarfile
root = os.path.expanduser("~/lab/registry/debug")
doc = {"name": "debug", "versions": {}, "dist-tags": {"latest": sys.argv[-1]}}
for v in sys.argv[1:]:
    path = f"{root}/-/debug-{v}.tgz"
    data = open(path, "rb").read()
    with tarfile.open(path) as t:
        meta = json.load(t.extractfile("package/package.json"))
    if "postinstall" in meta.get("scripts", {}):
        meta["hasInstallScript"] = True
    meta["dist"] = {"tarball": f"http://127.0.0.1:4873/debug/-/debug-{v}.tgz",
        "integrity": "sha512-" + base64.b64encode(hashlib.sha512(data).digest()).decode()}
    doc["versions"][v] = meta
json.dump(doc, open(f"{root}/index.json", "w"))
print("published:", " ".join(sys.argv[1:]))
P
cat > ~/lab/registry.py <<'P'
# 127.0.0.1 だけで待ち受ける、読み出し専用のレジストリ
import http.server, os
ROOT = os.path.expanduser("~/lab/registry")
class H(http.server.SimpleHTTPRequestHandler):
    def translate_path(self, path):
        full = os.path.join(ROOT, path.split("?")[0].strip("/"))
        return os.path.join(full, "index.json") if os.path.isdir(full) else full
http.server.ThreadingHTTPServer(("127.0.0.1", 4873), H).serve_forever()
P
nohup python3 ~/lab/registry.py >/dev/null 2>&1 &
python3 ~/lab/publish.py 4.4.1

sudo mkdir -p /srv/shop /srv/batch
for app in shop batch; do
  echo "{ \"name\": \"$app\", \"private\": true, \"dependencies\": { \"debug\": \"^4.4.1\" } }" | sudo tee /srv/$app/package.json >/dev/null
  echo 'registry=http://127.0.0.1:4873/' | sudo tee /srv/$app/.npmrc >/dev/null
  (cd /srv/$app && sudo npm install --no-audit --no-fund --silent)
done
echo 'AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE' | sudo tee /srv/shop/.env >/dev/null
cd /srv/shop && sudo git init -q && sudo git add package.json package-lock.json .npmrc
sudo git -c user.name=ops -c user.email=ops@example.com commit -qm "debug 4.4.1"

sudo roamswitch server config set lockfile_watch_dirs /srv/shop
sudo roamswitch server config set package_cve_map_languages_enabled true
sudo roamswitch server restart
sudo systemctl start roamswitch-update.service
cat /var/lib/roamswitch/package_cve_map_npm.VERSION

python3 ~/lab/publish.py 4.4.1 4.4.2
cd /srv/shop && sudo npm update --no-audit --no-fund
sleep 10
sudo roamswitch notifications | head -40

sudo roamswitch scan-packages /srv/shop /srv/batch | sed -n '/npm\/PyPI/,$p'

sudo find / -xdev -path '*/node_modules/debug/package.json' -exec grep -H '"version"' {} +
cd /srv/shop && sudo git diff package-lock.json | grep '^[-+] *"version"'
stat -c '%y %n' /srv/shop/node_modules/debug/package.json
sudo sh -c 'grep -H "argv" /root/.npm/_logs/*.log'

sudo roamswitch scan-scripts /srv/shop | sed -n '/一覧表示です/,$p'
sudo roamswitch events search --since 1h --text setup.js | grep -v 'events search'
sudo roamswitch events tree 7931

sudo roamswitch timeline
sudo roamswitch audit-secrets /srv/shop

python3 ~/lab/publish.py 4.4.1 4.4.3
cd /srv/shop
sudo rm -rf node_modules
sudo npm install debug@4.4.3 --save-exact --ignore-scripts --no-audit --no-fund
grep '"debug"' package.json
sudo rm -rf node_modules && sudo npm ci --ignore-scripts --no-audit --no-fund
sudo roamswitch scan-packages /srv/shop | sed -n '/npm\/PyPI/,$p'
sudo roamswitch scan-scripts /srv/shop | grep -F 'インストールスクリプトは'
sudo git -c user.name=ops -c user.email=ops@example.com commit -qam "debug を 4.4.3 に固定" && sudo git log --oneline

sudo roamswitch server config set lockfile_watch_dirs ''
sudo roamswitch server config set package_cve_map_languages_enabled false
sudo roamswitch server restart
kill $(sudo ss -ltnpH 'sport = :4873' | sed -n 's/.*pid=\([0-9]*\).*/\1/p')
sudo rm -rf /srv/shop /srv/batch ~/lab /root/.npm
sudo rm -f /var/lib/roamswitch/lockfile_fim.db /var/lib/roamswitch/lockfile_fim_notified.txt
sudo grep -E '^(lockfile_watch_dirs|package_cve_map_languages_enabled)=' /etc/roamswitch/server.conf
curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:4873/debug