@tangible/roller
Advanced tools
@tangible/roller - npm Package Compare versions
+8
-5
| { | ||
| "name": "@tangible/roller", | ||
| "type": "module", | ||
| "version": "2.1.6", | ||
| "version": "2.1.7", | ||
| "description": "Build project assets using Rollup and ESBuild", | ||
@@ -33,6 +33,5 @@ "homepage": "https://github.com/tangibleinc/tangible-roller", | ||
| "release": "npm publish --access public", | ||
| "test": "cd test && if [ ! -d node_modules ]; then npm install; fi && ../run", | ||
| "test:dev": "cd test && ../run dev", | ||
| "test:build": "cd test && ../run build", | ||
| "test:init": "cd test/build && ../../run init" | ||
| "test": "cd test && if [ ! -d node_modules ]; then npm install; fi && ../run run test.ts", | ||
| "test:install": "cd test && npm install", | ||
| "test:run": "cd test && ../run" | ||
| }, | ||
@@ -69,3 +68,7 @@ "dependencies": { | ||
| "zip-lib": "^1.0.4" | ||
| }, | ||
| "devDependencies": { | ||
| "@types/node": "^24.5.2", | ||
| "testra": "^2.1.5" | ||
| } | ||
| } |
New alerts
Network access
Supply chain riskThis module accesses the network.
Found 3 instances in 1 package
New author
Supply chain riskA new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.
Found 1 instance in 1 package
Shell access
Supply chain riskThis module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.
Found 1 instance in 1 package
Dynamic require
Supply chain riskDynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.
Found 1 instance in 1 package
Environment variable access
Supply chain riskPackage accesses environment variables, which may be a sign of credential stuffing or data theft.
Found 3 instances in 1 package
Filesystem access
Supply chain riskAccesses the file system, and could potentially read sensitive data.
Found 3 instances in 1 package
Long strings
Supply chain riskContains long string literals, which may be a sign of obfuscated or packed code.
Found 1 instance in 1 package
Fixed alerts
Network access
Supply chain riskThis module accesses the network.
Found 3 instances in 1 package
Shell access
Supply chain riskThis module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.
Found 1 instance in 1 package
Dynamic require
Supply chain riskDynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.
Found 1 instance in 1 package
Environment variable access
Supply chain riskPackage accesses environment variables, which may be a sign of credential stuffing or data theft.
Found 3 instances in 1 package
Filesystem access
Supply chain riskAccesses the file system, and could potentially read sensitive data.
Found 3 instances in 1 package
Long strings
Supply chain riskContains long string literals, which may be a sign of obfuscated or packed code.
Found 1 instance in 1 package
Improved metrics
- Total package byte prevSize
215601
0.02%Worsened metrics
- Dev dependency count
2
Infinity%- Number of medium supply chain risk alerts
6
20%