CLI option to report all non-whitelisted URLs used

This looks like a pretty awesome project and something I would like to include in Salus (www.github.com/coinbase/salus) to get better coverage on yarn and npm projects.

Is your feature request related to a problem? Please describe. Please describe the problem you are trying to solve.

I’d like to get a list of all URLs being used that don’t match the whitelist that fails a scan.

Describe the solution you’d like Please describe the desired behavior.

Instead of returning detected invalid origin for package: <package_name>, I would like to see the URL used in addition to the package name.

Preferably in a JSON format option for easier parsing but I can implement a rudimentary parser on this syntax if outputting in JSON is not going to be supported.

Describe alternatives you’ve considered Please describe alternative solutions or features you have considered.

[lirantal]

@nishils I believe that the PR at https://github.com/lirantal/lockfile-lint/pull/20 which landed a while ago is now providing this, right?

here is an example output now with a wrong URL:

$ npx lockfile-lint -p package-lock.json -t npm -s -a npm github.com -o "https:" "github:"

detected invalid host(s) for package: @babel/code-frame@7.5.5
    expected: registry.npmjs.org,github.com
    actual: registry.spmjs.org

error: command failed with exit code 1

[lirantal]

You are correct, we are not displaying anything about the URL, just the package. Agree with you completely 👍