@graphql-toolkit/code-file-loader - npm Package Compare versions

Comparing version 0.6.8-alpha-23bbb51.1 to 0.6.8-alpha-2cde5e8.4

dist/commonjs/extract-document-string-from-code-file.js

 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const graphql_1 = require("graphql");
-const graphql_tag_pluck_1 = require("graphql-tag-pluck");
 function calculateOptions(options) {
@@ -35,3 +34,4 @@ if (!options || !options.tagPluck) {
         try {
-            return (await graphql_tag_pluck_1.gqlPluckFromFile(source.name, calculateOptions(options))) || null;
+            const { gqlPluckFromFile } = eval(`require('graphql-tag-pluck')`);
+            return (await gqlPluckFromFile(source.name, calculateOptions(options))) || null;
         }
@@ -38,0 +38,0 @@ catch (e) {

dist/commonjs/load-from-code-file.js

@@ -7,3 +7,2 @@ "use strict";
 const common_1 = require("@graphql-toolkit/common");
-const fs_1 = require("fs");
 function isSchemaText(obj) {
@@ -53,3 +52,3 @@ return typeof obj === 'string';
         if (require && require.cache) {
-            filePath = require.resolve(filePath);
+            filePath = eval(`require.resolve('${filePath}')`);
             if (require.cache[filePath]) {
@@ -59,3 +58,3 @@ delete require.cache[filePath];
         }
-        const rawExports = await Promise.resolve().then(() => require(filePath));
+        const rawExports = await eval(`require('${filePath}');`);
         if (rawExports) {
@@ -86,3 +85,4 @@ let rawExport = rawExports.default || rawExports.schema || rawExports;
 async function tryToLoadFromCodeAst(filePath, options) {
-    const content = fs_1.readFileSync(filePath, 'utf-8');
+    const { readFileSync } = eval(`require('fs')`);
+    const content = readFileSync(filePath, 'utf-8');
     const foundDoc = await extract_document_string_from_code_file_1.extractDocumentStringFromCodeFile(new graphql_1.Source(content, filePath), options || {});
@@ -89,0 +89,0 @@ if (foundDoc) {

dist/esnext/extract-document-string-from-code-file.js

 import { parse } from 'graphql';
-import { gqlPluckFromFile } from 'graphql-tag-pluck';
 function calculateOptions(options) {
@@ -33,2 +32,3 @@ if (!options || !options.tagPluck) {
         try {
+            const { gqlPluckFromFile } = eval(`require('graphql-tag-pluck')`);
             return (await gqlPluckFromFile(source.name, calculateOptions(options))) || null;
@@ -35,0 +35,0 @@ }

dist/esnext/load-from-code-file.js

@@ -5,3 +5,2 @@ import { GraphQLSchema, parse, buildClientSchema, Source as GraphQLSource } from 'graphql';
 import { debugLog, printSchemaWithDirectives, asArray, fixWindowsPath } from '@graphql-toolkit/common';
-import { readFileSync } from 'fs';
 function isSchemaText(obj) {
@@ -51,3 +50,3 @@ return typeof obj === 'string';
         if (require && require.cache) {
-            filePath = require.resolve(filePath);
+            filePath = eval(`require.resolve('${filePath}')`);
             if (require.cache[filePath]) {
@@ -57,3 +56,3 @@ delete require.cache[filePath];
         }
-        const rawExports = await import(filePath);
+        const rawExports = await eval(`require('${filePath}');`);
         if (rawExports) {
@@ -84,2 +83,3 @@ let rawExport = rawExports.default || rawExports.schema || rawExports;
 async function tryToLoadFromCodeAst(filePath, options) {
+    const { readFileSync } = eval(`require('fs')`);
     const content = readFileSync(filePath, 'utf-8');
@@ -86,0 +86,0 @@ const foundDoc = await extractDocumentStringFromCodeFile(new GraphQLSource(content, filePath), options || {});

package.json

 {
   "name": "@graphql-toolkit/code-file-loader",
-  "version": "0.6.8-alpha-23bbb51.1+23bbb51",
+  "version": "0.6.8-alpha-2cde5e8.4+2cde5e8",
   "description": "A set of utils for faster development of GraphQL tools",
@@ -24,12 +24,11 @@ "repository": "[e-mail]:dotansimha/graphql-toolkit.git",
   "devDependencies": {
-    "@types/jest": "24.0.21",
+    "@types/jest": "24.0.22",
     "graphql": "14.5.8",
     "jest": "24.9.0",
     "ts-jest": "24.1.0",
-    "typescript": "3.6.4"
+    "typescript": "3.7.2"
   },
   "dependencies": {
-    "@graphql-toolkit/common": "0.6.8-alpha-23bbb51.1+23bbb51",
-    "graphql-tag-pluck": "0.8.7",
-    "tslib": "1.10.0"
+    "@graphql-toolkit/common": "0.6.8-alpha-2cde5e8.4+2cde5e8",
+    "graphql-tag-pluck": "0.8.7"
   },
@@ -39,3 +38,3 @@ "publishConfig": {
   },
-  "gitHead": "23bbb512598c95e67ba4476ca410e7049655db02"
+  "gitHead": "2cde5e8f3f6632320d783b2bebf7b57e7274a778"
 }

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Manifest confusion

Supply chain risk

This package has inconsistent metadata. This could be malicious or caused by an error when publishing the package.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Manifest confusion

Supply chain risk

This package has inconsistent metadata. This could be malicious or caused by an error when publishing the package.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

29249

increased by0.74%

Dependency count

3

decreased by-25%

Number of low supply chain risk alerts

4

decreased by-55.56%

Worsened metrics

Number of medium supply chain risk alerts

9

increased by800%

Dependency changes

• - Removedtslib@1.10.0

• - Removedtslib@1.10.0(transitive)

• Updated@graphql-toolkit/common@0.6.8-alpha-2cde5e8.4+2cde5e8