@dotenvx/dotenvx - npm Package Compare versions

Comparing version 1.14.0 to 1.14.1

CHANGELOG.md

@@ -5,4 +5,10 @@ # Changelog
 
-## [Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.14.0...main)
+## [Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.14.1...main)
 
+## 1.14.1
+
+### Changed
+
+* run precommit hook only on staged files ([#380](https://github.com/dotenvx/dotenvx/pull/380))
+
 ## 1.14.0
@@ -9,0 +15,0 @@

package.json

 {
-  "version": "1.14.0",
+  "version": "1.14.1",
   "name": "@dotenvx/dotenvx",
@@ -4,0 +4,0 @@ "description": "a better dotenv–from the creator of `dotenv`",

src/lib/services/precommit.js

@@ -10,2 +10,3 @@ /* istanbul ignore file */
 const InstallPrecommitHook = require('./../helpers/installPrecommitHook')
+const childProcess = require('child_process')
 const MISSING_GITIGNORE = '.env.keys' // by default only ignore .env.keys. all other .env* files COULD be included - as long as they are encrypted
@@ -48,19 +49,22 @@
       dotenvFiles.forEach(file => {
-        // check if that file is being ignored
-        if (ig.ignores(file)) {
-          if (file === '.env.example' || file === '.env.vault') {
-            const warning = new Error(`${file} (currently ignored but should not be)`)
-            warning.help = `? add !${file} to .gitignore with [echo "!${file}" >> .gitignore]`
-            warnings.push(warning)
-          }
-        } else {
-          if (file !== '.env.example' && file !== '.env.vault') {
-            const src = fs.readFileSync(file).toString()
-            const encrypted = isFullyEncrypted(src)
+        // check if file is going to be commited
+        if (this._isFileToBeCommitted(file)) {
+          // check if that file is being ignored
+          if (ig.ignores(file)) {
+            if (file === '.env.example' || file === '.env.vault') {
+              const warning = new Error(`${file} (currently ignored but should not be)`)
+              warning.help = `? add !${file} to .gitignore with [echo "!${file}" >> .gitignore]`
+              warnings.push(warning)
+            }
+          } else {
+            if (file !== '.env.example' && file !== '.env.vault') {
+              const src = fs.readFileSync(file).toString()
+              const encrypted = isFullyEncrypted(src)
 
-            // if contents are encrypted don't raise an error
-            if (!encrypted) {
-              const error = new Error(`${file} not encrypted (or not gitignored)`)
-              error.help = `? encrypt it with [dotenvx encrypt -f ${file}] or add ${file} to .gitignore with [echo ".env*" >> .gitignore]`
-              throw error
+              // if contents are encrypted don't raise an error
+              if (!encrypted) {
+                const error = new Error(`${file} not encrypted (or not gitignored)`)
+                error.help = `? encrypt it with [dotenvx encrypt -f ${file}] or add ${file} to .gitignore with [echo ".env*" >> .gitignore]`
+                throw error
+              }
             }
@@ -82,2 +86,14 @@ }
 
+  _isFileToBeCommitted (filePath) {
+    try {
+      const output = childProcess.execSync('git diff --cached --name-only').toString()
+      const files = output.split('\n')
+
+      return files.includes(filePath)
+    } catch (error) {
+      // consider file to be committed if there is an error (not using git)
+      return true
+    }
+  }
+
   _installPrecommitHook () {
@@ -84,0 +100,0 @@ return new InstallPrecommitHook().run()

New alerts

Potential vulnerability

Supply chain risk

Initial human review suggests the presence of a vulnerability in this package. It is pending further analysis and confirmation.

Found 1 instance in 1 package

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 9 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Potential vulnerability

Supply chain risk

Initial human review suggests the presence of a vulnerability in this package. It is pending further analysis and confirmation.

Found 1 instance in 1 package

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 9 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

199534

0.33%

Lines of code

3439

0.41%

Worsened metrics

Number of medium supply chain risk alerts

7

16.67%

No dependency changes