Repository: DataDog/guarddog (python)

Issue:
NPM: not detecting postinstall scripts
Hello team! Very cool tool you have created, and I am glad for the NPM support!

When testing this tool against different malicious packages I get no results, I took som examples from https://github.com/spaceraccoon/npm-zoo

For example:
https://github.com/spaceraccoon/npm-zoo/tree/master/packages/pizza-pasta/pizza-pasta-1.0.3
```
guarddog npm scan package.json
Found 0 potentially malicious indicators scanning package.json
```

```
guarddog npm verify package.json
Scanning using at most 16 parallel worker threads
```

Should this one be detected, or am not running the correct commands?

Cheers,

emil

Pull request:
Consider 'guarddog xxx scan .' a local target (fixes #175)
Running `guarddog npm scan .` should scan the local current directory, instead of scanning a remote package called `.`

Patch:
diff --git a/guarddog/cli.py b/guarddog/cli.py
index 7fdcb36..0279291 100644
--- a/guarddog/cli.py
+++ b/guarddog/cli.py
@@ -33,6 +33,8 @@ AVAILABLE_LOG_LEVELS = {
 }
 AVAILABLE_LOG_LEVELS_NAMES = list(map(lambda level: logging.getLevelName(level), AVAILABLE_LOG_LEVELS))
 
+log = logging.getLogger('guarddog')
+
 
 def common_options(fn):
     fn = click.option("--exit-non-zero-on-finding", default=False, is_flag=True,
@@ -139,6 +141,9 @@ def is_local_target(identifier: str) -> bool:
     if identifier.startswith("/") or identifier.startswith("./") or identifier.startswith("../"):
         return True
 
+    if identifier == ".":
+        return True
+
     # If this looks like an archive, consider it as a local target if the target exists on the local filesystem
     if identifier.endswith(".tar.gz") or identifier.endswith(".zip") or identifier.endswith(".whl"):
         return os.path.exists(identifier)
@@ -162,8 +167,10 @@ def _scan(identifier, version, rules, exclude_rules, output_format, exit_non_zer
         exit(1)
     results = {}
     if is_local_target(identifier):
+        log.debug(f"Considering that '{identifier}' is a local target, scanning filesystem")
         results = scanner.scan_local(identifier, rule_param)
     else:
+        log.debug(f"Considering that '{identifier}' is a remote target")
         try:
             results = scanner.scan_remote(identifier, version, rule_param)
         except Exception as e:
diff --git a/guarddog/scanners/scanner.py b/guarddog/scanners/scanner.py
index b158c82..863817d 100644
--- a/guarddog/scanners/scanner.py
+++ b/guarddog/scanners/scanner.py
@@ -307,6 +307,7 @@ class PackageScanner(Scanner):
 
         try:
             safe_extract(archive_path, target_path)
+            log.debug(f"Successfully extracted files to {target_path}")
         finally:
             log.debug(f"Removing temporary archive file {archive_path}")
             os.remove(archive_path)


Test patch:
diff --git a/tests/core/test_cli.py b/tests/core/test_cli.py
index 1326a96..8228d55 100644
--- a/tests/core/test_cli.py
+++ b/tests/core/test_cli.py
@@ -8,6 +8,7 @@ def test_is_local_target():
     assert guarddog.cli.is_local_target("/tmp/foo")
     assert guarddog.cli.is_local_target("./foo")
     assert guarddog.cli.is_local_target("../foo")
+    assert guarddog.cli.is_local_target(".")
     assert not guarddog.cli.is_local_target("foo")
 
     with unittest.mock.patch('os.path.exists') as mock: