@contrast/core - npm Package Compare versions

Comparing version 1.32.3 to 1.33.0

lib/agent-info.js

@@ -18,6 +18,7 @@ /*
 
+const { randomUUID } = require('crypto');
 const { name: agentName, version: agentVersion } = require('../package.json');
 
 module.exports = function init(core) {
-  // default to version of core
+  // default to name and version of core
   if (!core.agentName) {
@@ -30,3 +31,8 @@ core.agentName = agentName;
 
+  // default to a new random UUID
+  if (!core.reportingInstance) {
+    core.reportingInstance = randomUUID();
+  }
+
   return core;
 };

lib/app-info.js

@@ -170,3 +170,3 @@ /*
       try {
-        packageFile = findPackageJsonSync({ cwd: dir });
+        packageFile = process.env.npm_package_json ?? findPackageJsonSync({ cwd: dir });
         packageData = require(packageFile);
@@ -173,0 +173,0 @@ break;

lib/index.d.ts

@@ -16,3 +16,3 @@ /*
 
-import { AppInfo, Messages } from '@contrast/common';
+import { AppInfo, Messages, SystemInfo } from '@contrast/common';
 
@@ -36,2 +36,3 @@ interface Frame {
   agentVersion: string;
+  reportingInstance: string;
 
@@ -49,3 +50,3 @@ appInfo: AppInfo;
 
-  getSystemInfo(): any;
+  getSystemInfo(): Promise<SystemInfo>;
 }

lib/system-info/index.js

@@ -15,35 +15,27 @@ /*
  */
-
+// @ts-check
 'use strict';
 
-const path = require('path');
-const fs = require('fs');
+const fs = require('fs/promises');
 const os = require('os');
+const { getResourceID } = require('./cloud-resource-identifier');
 
-function isUsingPM2() {
-  const used = !!process.env.pmx;
-  let version;
+const MOUNTINFO_REGEX = /\/docker\/containers\/(.*?)\//;
+const CGROUP_REGEX = /:\/docker\/([^/]+)$/;
 
-  for (const pathVar of ['npm_package_json', 'PWD']) {
-    const packagePath = process.env[pathVar];
-    if (packagePath) {
-      try {
-        version = require(path.join(packagePath, 'package.json')).dependencies['pm2'];
-      } catch (err) {
-        //
-      }
-    }
-    if (version) break;
+function isUsingPM2(pkg) {
+  const result = { used: !!process.env.pmx, version: null };
+
+  if (pkg?.dependences?.['pm2']) {
+    result.version = pkg.dependencies['pm2'];
   }
 
-  return { used, ...(version && { version }) };
+  return result;
 }
 
-function isDocker() {
-  const MOUNTINFO_REGEX = /\/docker\/containers\/(.*?)\//;
-  const CGROUP_REGEX = /:\/docker\/([^/]+)$/;
-
+async function isDocker() {
   try {
-    const results = fs.readFileSync('/proc/self/mountinfo', 'utf8').match(MOUNTINFO_REGEX);
-    if (results) return { isDocker: true, containerID: results[1] };
+    const result = await fs.readFile('/proc/self/mountinfo', 'utf8');
+    const matches = result.match(MOUNTINFO_REGEX);
+    if (matches) return { isDocker: true, containerID: matches[1] };
   } catch (err) {
@@ -54,4 +46,5 @@ // else check /proc/self/cgroup
   try {
-    const results = fs.readFileSync('/proc/self/cgroup', 'utf8').match(CGROUP_REGEX);
-    if (results) return { isDocker: true, containerID: results[1] };
+    const result = await fs.readFile('/proc/self/cgroup', 'utf8');
+    const matches = result.match(CGROUP_REGEX);
+    if (matches) return { isDocker: true, containerID: matches[1] };
   } catch (err) {
@@ -62,3 +55,3 @@ // else check /.dockerenv
   try {
-    const result = fs.statSync('/.dockerenv');
+    const result = await fs.stat('/.dockerenv');
     if (result) return { isDocker: true, containerID: null };
@@ -76,9 +69,15 @@ } catch (err) {
     agentVersion,
-    config
+    config,
+    appInfo,
   } = core;
 
   // have values default to null so all required keys get serialized
-  core.getSystemInfo = function() {
-    const appPath = process.cwd();
+  core.getSystemInfo = async function getSystemInfo() {
+    // memoize for subsequent lookups
+    if (core._systemInfo) return core._systemInfo;
 
+    const cpus = os.cpus();
+    const totalmem = os.totalmem();
+    const freemem = os.freemem();
+
     const info = {
@@ -110,20 +109,24 @@ ReportDate: new Date().toISOString(),
         CPU: {
-          Type: os.cpus()[0].model,
-          Count: os.cpus().length,
+          Type: cpus[0].model,
+          Count: cpus.length,
         }
       },
       Host: {
-        Docker: isDocker(),
-        PM2: isUsingPM2(),
+        Docker: await isDocker(),
+        PM2: isUsingPM2(appInfo.pkg),
         Memory: {
-          Total: (os.totalmem() / 1e6).toFixed(0).concat(' MB'),
-          Free: (os.freemem() / 1e6).toFixed(0).concat(' MB'),
-          Used: ((os.totalmem() - os.freemem()) / 1e6).toFixed(0).concat(' MB'),
+          Total: (totalmem / 1e6).toFixed(0).concat(' MB'),
+          Free: (freemem / 1e6).toFixed(0).concat(' MB'),
+          Used: ((totalmem - freemem) / 1e6).toFixed(0).concat(' MB'),
         }
       },
-      Application: appPath ? require(path.join(appPath, 'package.json')) : null,
+      Application: appInfo.pkg,
     };
 
-    return info;
+    if (config.server.discover_cloud_resource) {
+      info.ResourceID = await getResourceID(config.inventory.gather_metadata_via);
+    }
+
+    return core._systemInfo = info;
   };
 };

package.json

 {
   "name": "@contrast/core",
-  "version": "1.32.3",
+  "version": "1.33.0",
   "description": "Preconfigured Contrast agent core services and models",
@@ -19,6 +19,7 @@ "license": "SEE LICENSE IN LICENSE",
   "dependencies": {
-    "@contrast/common": "1.21.3",
+    "@contrast/common": "1.22.0",
     "@contrast/find-package-json": "^1.0.0",
-    "@contrast/fn-inspect": "^4.0.0"
+    "@contrast/fn-inspect": "^4.0.0",
+    "axios": "^1.6.8"
   }
 }

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

40568

increased by9.77%

Number of package files

16

increased by6.67%

Lines of code

1044

increased by10.71%

Number of low supply chain risk alerts

6

decreased by-25%

Worsened metrics

Dependency count

4

increased by33.33%

Dependency changes

• + Addedaxios@^1.6.8

• + Added@contrast/common@1.22.0(transitive)

• + Addedasynckit@0.4.0(transitive)

• + Addedaxios@1.7.7(transitive)

• + Addedcombined-stream@1.0.8(transitive)

• + Addeddelayed-stream@1.0.0(transitive)

• + Addedfollow-redirects@1.15.9(transitive)

• + Addedform-data@4.0.1(transitive)

• + Addedmime-db@1.52.0(transitive)

• + Addedmime-types@2.1.35(transitive)

• + Addedproxy-from-env@1.1.0(transitive)

• - Removed@contrast/common@1.21.3(transitive)

• Updated@contrast/common@1.22.0