Require packages to be downloaded >= 100x/day

This should make it more difficult for people who are publishing
malicious packages to npm to get them on the CDN.
This commit is contained in:
MICHAEL JACKSON
2017-08-16 22:47:24 -07:00
parent 666d8afc95
commit 1173f91091
9 changed files with 148 additions and 37 deletions

View File

@ -0,0 +1,20 @@
const NPMDownloads = require('../NPMDownloads')
function checkMinDailyDownloads(minDailyDownloads) {
return function (req, res, next) {
NPMDownloads.getDaily(req.packageName, function (error, downloads) {
if (error) {
console.error(error)
next() // Keep going; this error isn't critical.
} else if (downloads == null) {
res.status(404).type('text').send(`Cannot find package "${req.packageName}"`)
} else if (downloads >= minDailyDownloads) {
next()
} else {
res.status(404).type('text').send(`Cannot serve requests for package "${req.packageName}" because it has been downloaded on average only ${downloads} time${downloads > 1 ? 's' : ''} per day this week`)
}
})
}
}
module.exports = checkMinDailyDownloads