[BasuruK]

Updated the security enhancements and addressed for the Shai-Hulud malware

Summary by CodeRabbit

• Chores
  • Added security-oriented npm scripts for auditing, fixing, checking, and scanning dependencies, including a composite full-scan that runs audit plus outdated.
  • Introduced safe scan variants that preserve audit exit codes while not failing on non-blocking outdated results.
  • Removed legacy color-related package overrides/resolutions to simplify dependency declarations.
  • Replaced removed entries with a single PrismJS override.

[coderabbitai]

Walkthrough

Adds new npm security scripts and a new security-scripts.json plus a standalone security-scan script; updates package.json scripts and replaces multiple color-related overrides/resolutions with a single prismjs override, removing the previous resolutions block.

Changes

Cohort / File(s)	Change Summary
NPM security scripts package.json, security-scripts.json, scripts/security-scan.js	Adds security scripts: security:audit, security:fix, security:check (uses --audit-level=high), security:outdated, and security:full-scan. Adds security-scripts.json with the same script definitions and a full-scan inline Node command. Adds scripts/security-scan.js which runs npm audit then npm outdated, preserves the audit exit code, logs progress, and exits with the audit result.
Dependency overrides/resolutions package.json	Removes overrides and the entire resolutions block for several color-related packages (color-convert, color-name, debug, is-arrayish, color, color-string, simple-swizzle). Replaces them with a single override entry: prismjs -> ^1.30.0.

Sequence Diagram(s)

sequenceDiagram
  actor Dev as Developer
  participant CLI as npm CLI
  participant Scripts as package.json / security-scripts.json
  participant Node as Node script (security-scan.js / inline)
  participant Registry as npm Registry

  Dev->>CLI: npm run security:full-scan
  CLI->>Scripts: load `security:full-scan`
  Scripts->>Node: run audit then outdated (capture audit exit)
  Node->>Registry: npm audit
  Registry-->>Node: audit results (may be non-zero)
  Node->>Registry: npm outdated
  Registry-->>Node: outdated results
  Node-->>CLI: "Security scan complete" (exit with audit exit code)
  CLI-->>Dev: output + final exit status

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

I nibble lines of script and log,
I chase the warnings through the fog.
Audit first, then updates scrolled,
Prism stands where colors rolled.
Hop, sniff, and thump — the tree looks strong! 🥕

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title Check	⚠️ Warning	The title correctly indicates the addition of security scripts for auditing and fixing vulnerabilities but includes an unrelated reference to “Shai-Hulud malware” that is not reflected in the code changes and makes the title overly long and less clear.	Please revise the title to focus solely on the primary change by removing the extraneous malware reference and simplifying it, for example: “feat: add npm security audit and fix scripts.”

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changes. Docstring coverage check skipped.

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch security-vulnerability-enhanements

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 2d5ca48 and 3b3d832.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (2)

• package.json (2 hunks)
• security-scripts.json (1 hunks)

[coderabbitai]

Actionable comments posted: 1

♻️ Duplicate comments (1)

package.json (1)

12-18: security:full-scan must fail on vulnerabilities.

Because security:audit-safe forces exit code 0, the full scan now always exits successfully—even when npm audit reports vulnerabilities—so automated checks stop catching issues. Inline the audit/outdated sequence and preserve the original audit status, e.g.:

-    "security:audit-safe": "npm audit || exit 0",
-    "security:outdated-safe": "npm outdated || exit 0",
-    "security:full-scan": "npm run security:audit-safe && npm run security:outdated-safe && echo Security scan complete"
+    "security:full-scan": "npm audit || AUDIT_EXIT=$?; npm outdated; echo Security scan complete; exit ${AUDIT_EXIT:-0}"

Update any duplicated definitions (like security-scripts.json) the same way so the scan still runs every step yet returns non-zero when vulnerabilities are present.

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 3b3d832 and 1a33794.

📒 Files selected for processing (2)

• package.json (2 hunks)
• security-scripts.json (1 hunks)

[coderabbitai]

Actionable comments posted: 1

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 1a33794 and 88212e5.

📒 Files selected for processing (3)

• package.json (2 hunks)
• scripts/security-scan.js (1 hunks)
• security-scripts.json (1 hunks)

🔇 Additional comments (3)

scripts/security-scan.js (1)

1-33: LGTM! Clean implementation of security scan with proper exit code handling.

The script correctly:

• Captures the audit exit code for CI/CD purposes
• Ensures both audit and outdated checks always run
• Treats outdated packages as informational only
• Exits with the original audit status to fail CI when vulnerabilities exist

package.json (2)

12-16: LGTM! Security scripts are well-structured and correctly implemented.

The security scripts properly leverage the dedicated security-scan.js file for the full scan, which ensures proper exit code handling for CI/CD pipelines.

---

40-40: Clarify security rationale for prismjs and color updates

• prismjs is now pinned to >=1.30.0 to address the DOM-Clobbering vulnerability fixed in 1.30.0.
• The removed color overrides relate to the color@5.0.1 npm account-takeover malware (Shai-Hulud), patched in 5.0.2.

Please update the PR description to reflect these security objectives.