@contrast/distringuish-prebuilt - npm Package Compare versions

Comparing version 1.9.0 to 2.0.0

index.js

 const semver = require('semver');
+const version = process.version.split('.')[0].substring(1);
+const platform = process.platform;
 let distringuish;
+
 try {
   distringuish = require('./build/Release/distringuish.node');
 } catch {
-  if (semver.lt(process.version, '12.0.0')) {
-    distringuish = require(`${__dirname}/${process.platform}-10/distringuish.node`);
-  } else {
-    distringuish = require(`${__dirname}/${process.platform}-12/distringuish.node`);
-  }
+  distringuish = require(`${__dirname}/${platform}-${version}/distringuish.node`);
 }
@@ -12,0 +11,0 @@

package.json

 {
   "name": "@contrast/distringuish-prebuilt",
-  "version": "1.9.0",
+  "version": "2.0.0",
   "description": "Contrast Security",
@@ -10,2 +10,3 @@ "main": "index.js",
   "scripts": {
+    "release": "node scripts/make-release.js",
     "test": "mocha test/test.js"
@@ -18,2 +19,14 @@ },
   },
+  "files": [
+    "index.js",
+    "win32-10/**",
+    "win32-12/**",
+    "win32-14/**",
+    "linux-10/**",
+    "linux-12/**",
+    "linux-14/**",
+    "darwin-10/**",
+    "darwin-12/**",
+    "darwin-14/**"
+  ],
   "devDependencies": {
@@ -23,4 +36,5 @@ "chai": "^4.2.0",
     "nan": "^2.14.0",
-    "node-gyp": "^4.0.0"
+    "node-gyp": "^4.0.0",
+    "yargs-interactive": "^3.0.0"
   }
 }

New alerts

Native code

Supply chain risk

Contains native code (e.g., compiled binaries or shared libraries). Including native code can obscure malicious behavior.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Fixed alerts

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1341249

increased by81.47%

Number of package files

11

increased by37.5%

Number of low supply chain risk alerts

2

decreased by-33.33%

Worsened metrics

Dev dependency count

5

increased by25%

Lines of code

33

decreased by-5.71%

Number of medium supply chain risk alerts

7

increased by75%

No dependency changes