@mapbox/node-pre-gyp
Advanced tools
+3
-0
@@ -5,2 +5,5 @@ # node-pre-gyp changelog | ||
| ## 2.0.2 | ||
| - Support private ACL for S3 buckets [#923](https://github.com/mapbox/node-pre-gyp/pull/923) | ||
| ## 2.0.1 | ||
@@ -7,0 +10,0 @@ - Update abi_crosswalk.json for abi 137 / node 24 (https://github.com/mapbox/node-pre-gyp/pull/904) |
+8
-2
@@ -32,3 +32,3 @@ 'use strict'; | ||
| // Check if AWS credentials are available | ||
| if (!process.env.AWS_ACCESS_KEY_ID && !process.env.AWS_SECRET_ACCESS_KEY) { | ||
| if (!process.env.AWS_ACCESS_KEY_ID || !process.env.AWS_SECRET_ACCESS_KEY) { | ||
| const err = new Error('Binary is private but AWS credentials not found. Please configure AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables, or use --fallback-to-build to compile from source.'); | ||
@@ -131,3 +131,6 @@ err.statusCode = 403; | ||
| log.info('install', 'Received 403 Forbidden - attempting authenticated download'); | ||
| return place_binary_authenticated(opts, targetDir, callback); | ||
| // Call place_binary_authenticated and return a special marker | ||
| // to prevent the promise chain from calling callback again | ||
| place_binary_authenticated(opts, targetDir, callback); | ||
| return { authenticated: true }; | ||
| } | ||
@@ -158,2 +161,5 @@ throw new Error(`response status ${res.status} ${res.statusText} on ${sanitized}`); | ||
| .then((text) => { | ||
| if (text && text.authenticated) { | ||
| return; // Don't call callback - place_binary_authenticated will handle it | ||
| } | ||
| log.info(text); | ||
@@ -160,0 +166,0 @@ callback(); |
+1
-1
| { | ||
| "name": "@mapbox/node-pre-gyp", | ||
| "description": "Node.js native addon binary install tool", | ||
| "version": "2.0.2-dev.2", | ||
| "version": "2.0.2", | ||
| "keywords": [ | ||
@@ -6,0 +6,0 @@ "native", |
Network access
Supply chain riskThis module accesses the network.
Found 2 instances in 1 package
Shell access
Supply chain riskThis module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.
Found 1 instance in 1 package
Dynamic require
Supply chain riskDynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.
Found 1 instance in 1 package
Environment variable access
Supply chain riskPackage accesses environment variables, which may be a sign of credential stuffing or data theft.
Found 12 instances in 1 package
Filesystem access
Supply chain riskAccesses the file system, and could potentially read sensitive data.
Found 1 instance in 1 package
Long strings
Supply chain riskContains long string literals, which may be a sign of obfuscated or packed code.
Found 1 instance in 1 package
URL strings
Supply chain riskPackage contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.
Found 1 instance in 1 package
Network access
Supply chain riskThis module accesses the network.
Found 2 instances in 1 package
New author
Supply chain riskA new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.
Found 1 instance in 1 package
Shell access
Supply chain riskThis module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.
Found 1 instance in 1 package
Dynamic require
Supply chain riskDynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.
Found 1 instance in 1 package
Environment variable access
Supply chain riskPackage accesses environment variables, which may be a sign of credential stuffing or data theft.
Found 12 instances in 1 package
Filesystem access
Supply chain riskAccesses the file system, and could potentially read sensitive data.
Found 1 instance in 1 package
Long strings
Supply chain riskContains long string literals, which may be a sign of obfuscated or packed code.
Found 1 instance in 1 package
No v1
QualityPackage is not semver >=1. This means it is not stable and does not support ^ ranges.
Found 1 instance in 1 package
URL strings
Supply chain riskPackage contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.
Found 1 instance in 1 package
192744
0.21%5305
0.11%1
-50%6
-14.29%