[feat] ability to `blacklist` package from user side

[loynoir]

Problem

• typo squatting

• miri reported UB package

Proposed Solution

ability to blacklist package from user side

Notes

pnpm does support blacklist

pnpm/pnpm#3962

[weihanglo]

For custom yank/deny list, see #13856.

However, a deny list will only help detect "known" bad crates, it can't automatically detect new typo squatting crates for people. For typo squat issue, see: #10655.

[epage]

Could you go into more detail on your proposed solution. That might help uncover some unspecified user requirements that would help the discussion.

pnpm does support blacklist

Could you describe pnpm's blacklist support and talk through how it applies or doesn't apply to Cargo? Its a big help rather than requiring people to find the right piece of documentation and absorbing the right parts.

[epage]

btw another related issue is #7193 which would allow people to create whatever denylist mechanism they wanted.

[loynoir]

Given

• typescipt is a typo of typescript

module.exports = {
  hooks: {
    readPackage(pkg) {
      console.debug({ pkg });

      if (pkg.name === "typescipt") {
        throw new Error("this package is not allowed");
      }

      return pkg;
    },
  },
};

Typo Example: typescipt is not typescript

$ npm_config_pnpmfile=$PWD/.pnpmfile.cjs pnpm i typescipt
{
  pkg: {
    name: 'tmp.msoazotxq8',
    version: '1.0.0',
    description: '',
    license: 'ISC',
    author: '',
    type: 'commonjs',
    main: 'index.js',
    scripts: { test: 'echo "Error: no test specified" && exit 1' },
    dependencies: {},
    devDependencies: {},
    optionalDependencies: {},
    peerDependencies: {}
  }
}
{
  pkg: {
    name: 'typescipt',
    version: '1.0.0',
    description: '',
    dist: {
      integrity: 'sha512-XXX',
      shasum: 'XXX',
      tarball: 'https://mirror.com/typescipt/-/typescipt-1.0.0.tgz',
      fileCount: 8,
      unpackedSize: 793,
      'npm-signature': '-----BEGIN PGP SIGNATURE-----\r\n' +
        ...
        '-----END PGP SIGNATURE-----\r\n',
      signatures: [Array]
    },
    directories: {},
    _hasShrinkwrap: false,
    hasInstallScript: false,
    dependencies: {},
    devDependencies: {},
    optionalDependencies: {},
    peerDependencies: {}
  }
}
 ERROR  this package is not allowed

pnpm: this package is not allowed
    at readPackage (/tmp/tmp.mSOaZoTXQ8/.pnpmfile.cjs:7:15)
    at pnpmfile.hooks.readPackage (/usr/lib/node_modules/pnpm/dist/pnpm.cjs:110690:34)
    at /usr/lib/node_modules/pnpm/dist/pnpm.cjs:110807:49
    at XWrap2.<anonymous> (/usr/lib/node_modules/pnpm/dist/pnpm.cjs:156737:124)
    at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
    at async resolveDependency (/usr/lib/node_modules/pnpm/dist/pnpm.cjs:151961:15)
    at async resolveDependenciesOfDependency (/usr/lib/node_modules/pnpm/dist/pnpm.cjs:151633:39)
    at async resolveDependenciesOfImporterDependency (/usr/lib/node_modules/pnpm/dist/pnpm.cjs:151448:23)
    at async Promise.all (index 0)
    at async /usr/lib/node_modules/pnpm/dist/pnpm.cjs:151354:48

OK Example

$ npm_config_pnpmfile=$PWD/.pnpmfile.cjs pnpm i ansi-regex
{
  pkg: {
    name: 'tmp.msoazotxq8',
    version: '1.0.0',
    description: '',
    license: 'ISC',
    author: '',
    type: 'commonjs',
    main: 'index.js',
    scripts: { test: 'echo "Error: no test specified" && exit 1' },
    dependencies: {},
    devDependencies: {},
    optionalDependencies: {},
    peerDependencies: {}
  }
}
{
  pkg: {
    name: 'ansi-regex',
    version: '6.1.0',
    description: 'Regular expression for matching ANSI escape codes',
    dist: {
      integrity: 'sha512-XXX',
      shasum: 'XXX',
      tarball: 'https://mirror.com/ansi-regex/-/ansi-regex-6.1.0.tgz',
      fileCount: 5,
      unpackedSize: 5412,
      signatures: [Array]
    },
    engines: { node: '>=12' },
    funding: 'https://github.com/chalk/ansi-regex?sponsor=1',
    directories: {},
    devDependencies: {
      'ansi-escapes': '^5.0.0',
      ava: '^3.15.0',
      tsd: '^0.21.0',
      xo: '^0.54.2'
    },
    _hasShrinkwrap: false,
    hasInstallScript: false,
    dependencies: {},
    optionalDependencies: {},
    peerDependencies: {}
  }
}
Packages: +1
+
Progress: resolved 1, reused 0, downloaded 1, added 1, done

dependencies:
+ ansi-regex 6.1.0

Done in 396ms using pnpm v10.14.0

The good part is it provide programable API.

So, if someone does care and not lazy, one may

• forbid popularity below X
• forbid keyboard distance difference above X compared with popular packages
• forbid license not match
• ...

Personal speaking

• I do not have big use of pnpm blacklist.

• But I do think cargo blacklist should have higher piority.

Speaking of why I think should have higher piority

• Javascript do not have UB.

• Rust does have UB.

Recently, because of my mistake, I encounter UB.

And under release mode, UB leads to

• X == 0

• With same X, X != 0

Thus

• I want to blacklist every miri reported UB package

• Whether it is in my dependency, or in deep dependency

• To prevent future weird bug