@esy-nightly/esy - npm Package Compare versions

Comparing version 0.4.10-e0cb01 to 0.4.10-e6e1e7

package.json

 {
   "name": "@esy-nightly/esy",
-  "version": "0.4.10-e0cb01",
+  "version": "0.4.10-e6e1e7",
   "license": "MIT",
@@ -5,0 +5,0 @@ "description": "Package builder for esy",

README.md

@@ -35,4 +35,10 @@ # esy
     │
-    ├── bin
+    ├── bin/esy
+    │   symlink (wrapper on Windows) for esy command, used for running tests
     │
+    ├── bin/esyInstallRelease.js
+    │   postinstall step for npm releases produced with `esy npm-release`
+    │   command. This is a built JS file which is developed in a separate flow
+    │   inside `esy-install-npm-release/` subdirectory (see below).
+    │
     ├── docs
@@ -68,2 +74,5 @@ │   esy end user documentation in markdown format.
     │
+    ├── esy-install-npm-release
+    │   Sources for `bin/esyInstallRelease.js`.
+    │
     ├── esy-command-expression
@@ -110,2 +119,15 @@ │   Parser for #{...} syntax used in esy manifests.
 
+### Updaating `bin/esyInstallRelease.js`
+
+`bin/esyInstallRelease.js` is developed separately within the `esy-install-npm-release/` directory.
+
+Run:
+
+```
+% make bin/esyInstallRelease.js
+```
+
+to update the `bin/esyInstallRelease.js` file with the latest changed, don't
+forget to commit it.
+
 ### Running Tests
@@ -112,0 +134,0 @@

New alerts

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

161564308

increased by0.41%

Lines of code

11498

increased by2085.93%

Number of lines in readme file

252

increased by9.57%

Worsened metrics

Number of low supply chain risk alerts

17

increased by142.86%

Number of medium supply chain risk alerts

19

increased by35.71%

No dependency changes