@appsignal/nodejs-ext - npm Package Compare versions

Comparing version 1.2.6 to 1.2.7

package.json

 {
   "name": "@appsignal/nodejs-ext",
-  "version": "1.2.6",
+  "version": "1.2.7",
   "main": "dist/index",
@@ -12,3 +12,3 @@ "types": "dist/index",
   "scripts": {
-    "install": "node scripts/extension.js && node-gyp rebuild",
+    "install": "node scripts/extension.js",
     "build": "tsc -p tsconfig.json",
@@ -20,3 +20,5 @@ "build:ext": "node-gyp rebuild",
     "link:yarn": "yarn link",
-    "test": "jest"
+    "test": "jest --filter=./test/filter.js",
+    "pretest:failure": "npm run clean",
+    "test:failure": "_TEST_APPSIGNAL_EXTENSION_FAILURE=true npm run install; _TEST_APPSIGNAL_EXTENSION_FAILURE=true jest --filter=./test/filter.js"
   },
@@ -23,0 +25,0 @@ "os": [

scripts/extension.js

@@ -20,9 +20,16 @@ #!/usr/bin/env node
   createBuildReport,
-  createDownloadReport
+  createDownloadReport,
+  reportPath
 } = require("./report")
 
 const EXT_PATH = path.join(__dirname, "/../ext/")
+const testExtensionFailure =
+  process.env._TEST_APPSIGNAL_EXTENSION_FAILURE === "true"
 
 function download(url, outputPath) {
   return new Promise((resolve, reject) => {
+    if (testExtensionFailure) {
+      throw new Error("AppSignal internal test failure")
+    }
+
     const file = fs.createWriteStream(outputPath)
@@ -70,9 +77,5 @@
   return new Promise(resolve => {
-    fs.writeFile(
-      "/tmp/appsignal-install-report.json",
-      JSON.stringify(report, null, 2),
-      () => {
-        return resolve()
-      }
-    )
+    fs.writeFile(reportPath(), JSON.stringify(report, null, 2), () => {
+      return resolve()
+    })
   })
@@ -95,4 +98,4 @@ }
   console.error(
-    `AppSignal currently does not know about your system architecture 
-    (${architecture}). Please let us know at [e-mail], we aim to 
+    `AppSignal currently does not know about your system architecture
+    (${architecture}). Please let us know at [e-mail], we aim to
     support everything our customers run.`
@@ -110,5 +113,17 @@ )
 
+function install() {
+  return new Promise((resolve, reject) => {
+    childProcess.exec("node-gyp rebuild", error => {
+      if (error) {
+        return reject(error)
+      } else {
+        return resolve()
+      }
+    })
+  })
+}
+
 // Script logic begins here
 ;(function () {
-  if (hasLocalBuild()) {
+  if (hasLocalBuild() && !testExtensionFailure) {
     // check for a local build (dev only)
@@ -121,4 +136,4 @@ console.warn(`Using local build for agent. Skipping download.`)
     console.error(
-      `AppSignal currently does not support your system architecture 
-        (${process.platform} ${process.arch}). Please let us know at 
+      `AppSignal currently does not support your system architecture
+        (${process.platform} ${process.arch}). Please let us know at
         [e-mail], we aim to support everything our customers run.`
@@ -132,4 +147,4 @@ )
     console.error(
-      `AppSignal currently does not support your operating system (${process.platform}). 
-      Please let us know at [e-mail], we aim to support everything 
+      `AppSignal currently does not support your operating system (${process.platform}).
+      Please let us know at [e-mail], we aim to support everything
       our customers run.`
@@ -154,3 +169,2 @@ )
     .then(() => {
-      // once extracted, we can then hand off to node-gyp for building
       // @TODO: add cleanup step
@@ -163,5 +177,10 @@ console.log("The agent has downloaded successfully! Building...")
       })
-
       report.result.status = "unknown"
 
+      // Once extracted, we hand it off to node-gyp for building
+      return install().then(() => {
+        report.result.status = "success"
+      })
+    })
+    .then(() => {
       return dumpReport(report).then(() => {
@@ -174,2 +193,7 @@ process.exit(0)
 
+      report.result = {
+        status: "error",
+        error: error.message,
+        backtrace: error.stack.split("\n")
+      }
       report.download = createDownloadReport({
@@ -176,0 +200,0 @@ verified: false,

scripts/extension/constants.js

@@ -1,2 +0,2 @@
-const AGENT_VERSION = "9f282f3"
+const AGENT_VERSION = "271250f"
 
@@ -6,53 +6,53 @@ const TRIPLES = {
     checksum:
-      "c279d061ac04b53c8e2ea21b7714d4d54964495124ddc7e794ba998366f9c195",
+      "059d8c23209aae12da3fdf2b6e7609eda15412365a7e29f426fd7db8d677664e",
     downloadUrl:
-      "https://appsignal-agent-releases.global.ssl.fastly.net/9f282f3/appsignal-x86_64-darwin-all-static.tar.gz"
+      "https://appsignal-agent-releases.global.ssl.fastly.net/271250f/appsignal-x86_64-darwin-all-static.tar.gz"
   },
   "universal-darwin": {
     checksum:
-      "c279d061ac04b53c8e2ea21b7714d4d54964495124ddc7e794ba998366f9c195",
+      "059d8c23209aae12da3fdf2b6e7609eda15412365a7e29f426fd7db8d677664e",
     downloadUrl:
-      "https://appsignal-agent-releases.global.ssl.fastly.net/9f282f3/appsignal-x86_64-darwin-all-static.tar.gz"
+      "https://appsignal-agent-releases.global.ssl.fastly.net/271250f/appsignal-x86_64-darwin-all-static.tar.gz"
   },
   "aarch64-linux": {
     checksum:
-      "3054b6e3bcab8c8959d4e87eb6fd9fc7a5821e0986c8e733154c2b76251c9e70",
+      "cb269522a2b360bfa0c487a69972b1b2baf289f4becbb53c8387d25a2c8cc31e",
     downloadUrl:
-      "https://appsignal-agent-releases.global.ssl.fastly.net/9f282f3/appsignal-aarch64-linux-all-static.tar.gz"
+      "https://appsignal-agent-releases.global.ssl.fastly.net/271250f/appsignal-aarch64-linux-all-static.tar.gz"
   },
   "i686-linux": {
     checksum:
-      "30554989a59632cdaf8fdf5d15024b866d32930e91c080425955842e8078952b",
+      "a5c887b7d4c8a56daf0c56b9a97c63e43c18b8fef3abca019c60ddadeaffb4d7",
     downloadUrl:
-      "https://appsignal-agent-releases.global.ssl.fastly.net/9f282f3/appsignal-i686-linux-all-static.tar.gz"
+      "https://appsignal-agent-releases.global.ssl.fastly.net/271250f/appsignal-i686-linux-all-static.tar.gz"
   },
   "x86-linux": {
     checksum:
-      "30554989a59632cdaf8fdf5d15024b866d32930e91c080425955842e8078952b",
+      "a5c887b7d4c8a56daf0c56b9a97c63e43c18b8fef3abca019c60ddadeaffb4d7",
     downloadUrl:
-      "https://appsignal-agent-releases.global.ssl.fastly.net/9f282f3/appsignal-i686-linux-all-static.tar.gz"
+      "https://appsignal-agent-releases.global.ssl.fastly.net/271250f/appsignal-i686-linux-all-static.tar.gz"
   },
   "x86_64-linux": {
     checksum:
-      "f11fa7ec493c3668e965ef4cff077d44fe55101197a5eeaf50ccacf7314eba2b",
+      "840f5b06c5f300a3ddf9b61c6acc51d6148ba26464d1652356edc79cf218e200",
     downloadUrl:
-      "https://appsignal-agent-releases.global.ssl.fastly.net/9f282f3/appsignal-x86_64-linux-all-static.tar.gz"
+      "https://appsignal-agent-releases.global.ssl.fastly.net/271250f/appsignal-x86_64-linux-all-static.tar.gz"
   },
   "x86_64-linux-musl": {
     checksum:
-      "0dae02e77e244275b69bb8332e79bdcb0e0fa3b6b6f84744780ce0baffa9784f",
+      "b8d0ae2183abcdb0d05cde1836d932f5d3931f16d28cbfdcae83b79c374bb4d0",
     downloadUrl:
-      "https://appsignal-agent-releases.global.ssl.fastly.net/9f282f3/appsignal-x86_64-linux-musl-all-static.tar.gz"
+      "https://appsignal-agent-releases.global.ssl.fastly.net/271250f/appsignal-x86_64-linux-musl-all-static.tar.gz"
   },
   "x86_64-freebsd": {
     checksum:
-      "d9146a04bbbb85dccf22c84cacfa924ee8b7e2ff8ed79402aba14ac4333e440f",
+      "d7937f8eb28bb6cda7d0ab4fb14aa8f98f11e237d753adb327ebee755e80da2f",
     downloadUrl:
-      "https://appsignal-agent-releases.global.ssl.fastly.net/9f282f3/appsignal-x86_64-freebsd-all-static.tar.gz"
+      "https://appsignal-agent-releases.global.ssl.fastly.net/271250f/appsignal-x86_64-freebsd-all-static.tar.gz"
   },
   "amd64-freebsd": {
     checksum:
-      "d9146a04bbbb85dccf22c84cacfa924ee8b7e2ff8ed79402aba14ac4333e440f",
+      "d7937f8eb28bb6cda7d0ab4fb14aa8f98f11e237d753adb327ebee755e80da2f",
     downloadUrl:
-      "https://appsignal-agent-releases.global.ssl.fastly.net/9f282f3/appsignal-x86_64-freebsd-all-static.tar.gz"
+      "https://appsignal-agent-releases.global.ssl.fastly.net/271250f/appsignal-x86_64-freebsd-all-static.tar.gz"
   }
@@ -59,0 +59,0 @@ }

scripts/report.js

@@ -0,1 +1,2 @@
+const crypto = require("crypto")
 const path = require("path")
@@ -79,6 +80,19 @@
 
+// This implementation should match the `packages/nodejs/src/diagnose.ts`
+// implementation to generate the same path.
+function reportPath() {
+  // Navigate up to the app dir. Move up the scripts dir, package dir,
+  // @appsignal dir and node_modules dir.
+  const appPath = path.join(__dirname, "../../../../")
+  const hash = crypto.createHash("sha256")
+  hash.update(appPath)
+  const reportPathDigest = hash.digest("hex")
+  return path.join(`/tmp/appsignal-${reportPathDigest}-install.report`)
+}
+
 module.exports = {
   createReport,
   createBuildReport,
-  createDownloadReport
+  createDownloadReport,
+  reportPath
 }

New alerts

Install scripts

Supply chain risk

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

41893

6.7%

Number of package files

13

18.18%

Lines of code

525

17.71%

Worsened metrics

Number of high supply chain risk alerts

1

Infinity%

Number of low supply chain risk alerts

11

57.14%

Number of medium supply chain risk alerts

5

25%

No dependency changes