@socketsecurity/cli - npm Package Compare versions

Comparing version 0.14.137 to 0.14.138

package.json

 {
   "name": "@socketsecurity/cli",
-  "version": "0.14.137",
+  "version": "0.14.138",
   "description": "CLI tool for Socket.dev",
@@ -72,4 +72,3 @@ "homepage": "https://github.com/SocketDev/socket-cli",
   "dependencies": {
-    "@socketsecurity/registry": "1.0.152",
-    "blessed": "0.1.81"
+    "@socketsecurity/registry": "1.0.153"
   },
@@ -122,2 +121,3 @@ "devDependencies": {
     "@vitest/coverage-v8": "3.1.1",
+    "blessed": "0.1.81",
     "blessed-contrib": "4.11.0",
@@ -148,3 +148,3 @@ "browserslist": "4.24.4",
     "mock-fs": "5.5.0",
-    "nock": "14.0.3",
+    "nock": "14.0.4",
     "npm-package-arg": "12.0.2",
@@ -151,0 +151,0 @@ "npm-run-all2": "7.0.2",

New alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 27 instances in 1 package

Mixed license

License

(Experimental) Package contains multiple licenses.

Found 1 instance in 1 package

Non-permissive License

License

(Experimental) A license not known to be considered permissive was found.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

7989889

21.93%

Dependency count

1

-50%

Number of package files

124

463.64%

Lines of code

167190

55.44%

Worsened metrics

Dev dependency count

92

1.1%

Number of low license alerts

2

Infinity%

License quality

90

-10%

Number of low supply chain risk alerts

79

558.33%

Number of medium supply chain risk alerts

4

300%

Dependency changes

• + Added

  @socketsecurity/registry@1.0.153
  (transitive)

• - Removed

  blessed@0.1.81

• - Removed

  @socketsecurity/registry@1.0.152
  (transitive)

• - Removed

  blessed@0.1.81
  (transitive)

• Updated

  @socketsecurity/registry@1.0.153