@mongodb-js/oidc-plugin - npm Package Compare versions

Comparing version 0.1.0 to 0.1.1

dist/plugin.js

@@ -55,4 +55,28 @@ "use strict";
     return async ({ url }) => {
-        // 'open' 9.x+ is ESM-only.
-        const open = (await Promise.resolve().then(() => __importStar(require('open')))).default;
+        // 'open' 9.x+ is ESM-only. However, TypeScript transpiles
+        // the `await import()` here to `require()`, which fails to load
+        // the package at runtime. We cannot use one of the typical workarounds
+        // for loading ESM packages unconditionally, because we need to be
+        // able to webpack this file (e.g. in Compass), which means that we
+        // need to use imports with constant string literal arguments.
+        // eslint-disable-next-line @typescript-eslint/consistent-type-imports
+        let open;
+        try {
+            open = (await Promise.resolve().then(() => __importStar(require('open')))).default;
+        }
+        catch (err) {
+            if (err &&
+                typeof err === 'object' &&
+                'code' in err &&
+                err.code === 'ERR_REQUIRE_ESM' &&
+                typeof __webpack_require__ === 'undefined') {
+                // This means that the import() above was transpiled to require()
+                // and that that require() called failed because it saw actual on-disk ESM.
+                // In this case, it should be safe to use eval'ed import().
+                open = (await eval("import('open')")).default;
+            }
+            else {
+                throw err;
+            }
+        }
         const child = await open(url);
@@ -59,0 +83,0 @@ child.unref();

package.json

@@ -16,3 +16,3 @@ {
   "homepage": "https://github.com/mongodb-js/oidc-plugin",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "repository": {
@@ -19,0 +19,0 @@ "type": "git",

New alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

148790

increased by1.07%

Lines of code

2067

increased by1.17%

Worsened metrics

Number of medium supply chain risk alerts

4

increased by33.33%

No dependency changes