@esy-nightly/esy - npm Package Compare versions

Comparing version 0.4.10-8a638d to 0.4.10-96abc0

package.json

 {
   "name": "@esy-nightly/esy",
-  "version": "0.4.10-8a638d",
+  "version": "0.4.10-96abc0",
   "license": "MIT",
@@ -14,3 +14,3 @@ "description": "Package builder for esy",
   "bin": {
-    "esy": "_build/default/esy/bin/esyCommand.exe"
+    "esy": "_build/default/bin/esy.exe"
   },
@@ -17,0 +17,0 @@ "files": [

postinstall.js

@@ -19,3 +19,4 @@ /**
 const binariesToCopy = [
-  path.join('_build', 'default', 'esy', 'bin', 'esyCommand.exe'),
+  path.join('_build', 'default', 'bin', 'esy.exe'),
+  path.join('_build', 'default', 'bin', 'esyInstallRelease.js'),
   path.join(
@@ -22,0 +23,0 @@ '_build',

README.md

@@ -35,4 +35,10 @@ # esy
     │
-    ├── bin
+    ├── bin/esy
+    │   symlink (wrapper on Windows) for esy command, used for running tests
     │
+    ├── bin/esyInstallRelease.js
+    │   postinstall step for npm releases produced with `esy npm-release`
+    │   command. This is a built JS file which is developed in a separate flow
+    │   inside `esy-install-npm-release/` subdirectory (see below).
+    │
     ├── docs
@@ -68,2 +74,5 @@ │   esy end user documentation in markdown format.
     │
+    ├── esy-install-npm-release
+    │   Sources for `bin/esyInstallRelease.js`.
+    │
     ├── esy-command-expression
@@ -110,2 +119,15 @@ │   Parser for #{...} syntax used in esy manifests.
 
+### Updaating `bin/esyInstallRelease.js`
+
+`bin/esyInstallRelease.js` is developed separately within the `esy-install-npm-release/` directory.
+
+Run:
+
+```
+% make bin/esyInstallRelease.js
+```
+
+to update the `bin/esyInstallRelease.js` file with the latest changed, don't
+forget to commit it.
+
 ### Running Tests
@@ -112,0 +134,0 @@

New alerts

Native code

Supply chain risk

Contains native code (e.g., compiled binaries or shared libraries). Including native code can obscure malicious behavior.

Found 1 instance in 1 package

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Fixed alerts

Native code

Supply chain risk

Contains native code (e.g., compiled binaries or shared libraries). Including native code can obscure malicious behavior.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

162868168

increased by1.2%

Number of package files

20

increased by17.65%

Lines of code

45636

increased by8576.05%

Number of lines in readme file

252

increased by9.57%

Worsened metrics

Number of low supply chain risk alerts

53

increased by657.14%

Number of medium supply chain risk alerts

34

increased by142.86%

No dependency changes