@vercel/nft - npm Package Compare versions

Comparing version 0.29.0 to 0.29.1

package.json

 {
   "name": "@vercel/nft",
-  "version": "0.29.0",
+  "version": "0.29.1",
   "repository": "vercel/nft",
@@ -25,3 +25,3 @@ "license": "MIT",
   "dependencies": {
-    "@mapbox/node-pre-gyp": "^2.0.0-rc.0",
+    "@mapbox/node-pre-gyp": "^2.0.0",
     "@rollup/pluginutils": "^5.1.3",
@@ -75,3 +75,3 @@ "acorn": "^8.6.0",
     "esm": "^3.2.25",
-    "express": "^4.19.2",
+    "express": "^4.21.2",
     "fast-glob": "^3.1.1",
@@ -78,0 +78,0 @@ "fetch-h2": "^2.2.0",

New alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Debug access

Supply chain risk

Uses debug, reflection and dynamic code execution features.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Fixed alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Debug access

Supply chain risk

Uses debug, reflection and dynamic code execution features.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Worsened metrics

Total package byte prevSize

331188

0

Dependency changes

• Updated

  @mapbox/node-pre-gyp@^2.0.0