Issue with tarballs - artifactResultsToAlerts

[OnePieceNZ]

Bug: artifactResultsToAlerts crashes on packages without alerts

Location

sfw-free binary v1.8.0, in the bundled JS at the function registered as
artifactResultsToAlerts (minified name: n_).

The function (decompiled)

function artifactResultsToAlerts(results) {
  return results
    .flatMap(pkg => pkg.alerts.map(alert => ({
      ...alert,
      inputPurl: pkg.inputPurl ?? "",
      packageName: pkg.name,
      packageType: pkg.type,
      packageVersion: pkg.version,
    })))
    .filter(a => a.action === "error" || a.action === "warn");
}

The bug

The schema (Cc) defines alerts as optional:

alerts: s.array(W1).optional()

So when the Socket API returns a package result where alerts is undefined
(which happens for private/scoped packages like @private/* that aren't in their
database), the code does:

pkg.alerts.map(...)
//  ^^^^^^ undefined

This throws:

TypeError: Cannot read properties of undefined (reading 'map')

Call chain

1. npm CONNECT request intercepted by sfw-free proxy
2. fetchBlockStatus → getPurlAlertInfo → Zg (fetchAlerts) → t_ (fetchFreeAlerts)
3. t_ calls o_ or i_ which are API wrappers created by dr(url, method, params, schema, parser, transform)
4. n_ (artifactResultsToAlerts) is passed as the transform (6th arg) to dr
5. Inside dr, after successful schema validation: return [o ? o(P) : P, null]
6. So n_(validatedResults) is called — crashes if any result has alerts: undefined

Impact

The TypeError propagates up, killing the proxy CONNECT handler. npm sees
ECONNRESET on the tarball download socket.

Fix

function artifactResultsToAlerts(results) {
  return results
    .flatMap(pkg => (pkg.alerts ?? []).map(alert => ({
      ...alert,
      inputPurl: pkg.inputPurl ?? "",
      packageName: pkg.name,
      packageType: pkg.type,
      packageVersion: pkg.version,
    })))
    .filter(a => a.action === "error" || a.action === "warn");
}

One-character-class fix: pkg.alerts?.map(...) with .flatMap would also work
since flatMap skips undefined returns, but (pkg.alerts ?? []).map(...) is more
explicit.

[marcbachmann]

I'm observing the same issue for private packages.

That's the debug log entry:

{
  description: 'Error caught at boundary "CONNECT request"',
  details: "TypeError Cannot read properties of undefined (reading 'map') [sfw-free.js:57:43077 <- Array.flatMap (<anonymous>) <- artifactResultsToAlerts (sfw-free.js:57:43057) <- sfw-free.js:23:32952 <- process.processTicksAndRejections (task_queues:105:5) <- sfw-free.js:23:33187 <- async Promise.all (index 0) <- async fetchFreeAlerts (sfw-free.js:57:43272) <- async getPackageAlerts (sfw-free.js:59:157) <- async getPurlAlertInfo (sfw-free.js:91:4231)]",
  eventType: 'serviceError',
  scope: 'request'
}

npm error code ECONNRESET
npm error errno ECONNRESET
npm error network request to https://registry.npmjs.org/@scope/package/-/package-34.1.1.tgz failed, reason: socket hang up
npm error network This is a problem related to network connectivity.
npm error network In most cases you are behind a proxy or have bad network settings.
npm error network
npm error network If you are behind a proxy, please make sure that the 'proxy' config is set properly.  See: 'npm help config'
npm error A complete log of this run can be found in: /Users/marcbachmann/.npm/_logs/2026-05-05T09_11_30_564Z-debug-0.log
``

[kasperisager]

We're hitting this across our repos and have had to disable Socket Firewall for the time being.