@heroku-cli/command - npm Package Compare versions

Comparing version 11.7.0 to 11.8.0

lib/api-client.js

@@ -162,3 +162,3 @@ "use strict";
                     }
-                    const isHerokuApi = exports.ALLOWED_HEROKU_DOMAINS.some(domain => targetUrl.hostname.endsWith(`.${domain}`));
+                    const isHerokuApi = exports.ALLOWED_HEROKU_DOMAINS.some(domain => targetUrl.hostname.endsWith(`.${domain}`) || targetUrl.hostname === domain);
                     const isLocalhost = exports.LOCALHOST_DOMAINS.includes(targetUrl.hostname);
@@ -165,0 +165,0 @@ if (isHerokuApi || isLocalhost) {

lib/vars.js

@@ -72,3 +72,3 @@ "use strict";
         const cleanHost = host.replace(/^https?:\/\//, '');
-        return api_client_1.ALLOWED_HEROKU_DOMAINS.some(domain => cleanHost.endsWith(`.${domain}`)) || api_client_1.LOCALHOST_DOMAINS.some(domain => cleanHost.includes(domain));
+        return api_client_1.ALLOWED_HEROKU_DOMAINS.some(domain => cleanHost.endsWith(`.${domain}`) || cleanHost === domain) || api_client_1.LOCALHOST_DOMAINS.some(domain => cleanHost.includes(domain));
     }
@@ -75,0 +75,0 @@ }

package.json

 {
   "name": "@heroku-cli/command",
   "description": "base class for Heroku CLI commands",
-  "version": "11.7.0",
+  "version": "11.8.0",
   "author": "Heroku",
@@ -6,0 +6,0 @@ "bugs": "https://github.com/heroku/heroku-cli-command/issues",

New alerts

Network access

Supply chain risk

This module accesses the network.

Found 2 instances in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 17 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Network access

Supply chain risk

This module accesses the network.

Found 2 instances in 1 package

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 17 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

88133

0.06%

Worsened metrics

Number of medium supply chain risk alerts

18

5.88%

No dependency changes