@yao-pkg/pkg - npm Package Compare versions

Comparing version 5.12.1 to 5.13.0

lib-es5/producer.js

@@ -19,8 +19,24 @@ "use strict";
 const compress_type_1 = require("./compress_type");
-function discoverPlaceholder(binaryBuffer, searchString, padder) {
+function discoverPlaceholder(binaryBuffer, searchString, padder, searchOffset = 0) {
     const placeholder = Buffer.from(searchString);
-    const position = binaryBuffer.indexOf(placeholder);
+    const position = binaryBuffer.indexOf(placeholder, searchOffset);
     if (position === -1) {
         return { notFound: true };
     }
+    /**
+     * the PAYLOAD/PRELUDE placeholders can occur twice in the binaries:
+     *  - in source text as a string literal
+     *  - in bytecode as a raw string
+     * the ordering depends on the platform - we need to make sure that
+     * the bytecode string is replaced, not the source literal.
+     *
+     * this rejects the source code literal if it occurs first in the binary
+     * also see: https://github.com/yao-pkg/pkg/pull/86
+     */
+    if (binaryBuffer[position - 1] === 39 /* ascii for ' APOSTROPHE */) {
+        const nextPlaceholder = discoverPlaceholder(binaryBuffer, searchString, padder, position + placeholder.length);
+        if (!('notFound' in nextPlaceholder)) {
+            return nextPlaceholder;
+        }
+    }
     return { position, size: placeholder.length, padder };
@@ -27,0 +43,0 @@ }

package.json

 {
   "name": "@yao-pkg/pkg",
-  "version": "5.12.1",
+  "version": "5.13.0",
   "description": "Package your Node.js project into an executable",
@@ -28,3 +28,3 @@ "main": "lib-es5/index.js",
     "@babel/types": "7.23.0",
-    "@yao-pkg/pkg-fetch": "3.5.9",
+    "@yao-pkg/pkg-fetch": "3.5.10",
     "chalk": "^4.1.2",
@@ -31,0 +31,0 @@ "fs-extra": "^9.1.0",

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

234278

increased by0.33%

Lines of code

6312

increased by0.25%

Dependency changes

• + Added@yao-pkg/pkg-fetch@3.5.10(transitive)

• - Removed@yao-pkg/pkg-fetch@3.5.9(transitive)

• Updated@yao-pkg/pkg-fetch@3.5.10