⚠️ Algolia search returns malicious/dangerous packages removed from npm registry search

[alex-key]

Describe the feature

While working on another search-related topic #1996 I've found that Algolia returns packages, which are basically ad for download stolen e-books. It appears that npm already marked these packages as malicious.

Example (marked as "Security holding package"):
https://npmx.dev/package/dowload_ebok_voir_grand_by_luc_poirier_bdn67
https://www.npmjs.com/package/dowload_ebok_voir_grand_by_luc_poirier_bdn67
https://registry.npmjs.org/dowload_ebok_voir_grand_by_luc_poirier_bdn67

Example similar but NOT marked as dangerous:
https://npmx.dev/package/dowload_ebok_bone_t01_by_jeff_smith_g9wli
https://www.npmjs.com/package/dowload_ebok_bone_t01_by_jeff_smith_g9wli
https://registry.npmjs.org/dowload_ebok_bone_t01_by_jeff_smith_g9wli

NPM also filters out packages that looks similar, but not yet marked as "security holding", but Algolia search returns it.

Algolia result for "download_ebook":
https://npmx.dev/search?q=dowload_ebook

npm search result:
https://npmx.dev/search?q=download_ebook&p=npm
https://registry.npmjs.org/-/v1/search?text=download_ebook&size=10

npmjs.org:
https://www.npmjs.com/search?q=dowload_ebook

To discuss:

• add internal logic to detect malicious packages and mark in UI when entered by direct link (similar to e18e issues). Maybe shold be part of e18e
• add internal filtering of Algolia results to remove such packages

Additional information

• Would you be willing to help implement this feature?

Final checks

• Read the contribution guide.
• Check existing issues.

[ghostdevv]

If we want packages that are removed for security reasons then we should create an issue upstream imo, but for now we could filter these out - if it's not been removed by npm though I'm not sure how we'd filter these out 🤔

[alex-key]

If we want packages that are removed for security reasons then we should create an issue upstream imo, but for now we could filter these out - if it's not been removed by npm though I'm not sure how we'd filter these out 🤔

We could at least filter out everything that has version v0.0.1-security or description security holding package from Algolia results

[ghostdevv]

If we want packages that are removed for security reasons then we should create an issue upstream imo, but for now we could filter these out - if it's not been removed by npm though I'm not sure how we'd filter these out 🤔

We could at least filter out everything that has version v0.0.1-security or description security holding package from Algolia results

It's not technically correct, but it's a good stopgap

[alex-key]

npm does not add any specific flag in their package entity. I think that version check is the only valid check for security issues, but it's not enough to detect all of them

[shuuji3]

We could at least filter out everything that has version v0.0.1-security or description security holding package from Algolia results

I made a PR which filters out packages with BOTH condition. My assumption is that npm should put both hard-coded values.

I don't know if there's a good way to find not-yet flagged packages though.

[mootari]

Related: algolia/npm-search#657