blume - npm Package Compare versions
New alerts
Environment variable access
Supply chain riskPackage accesses environment variables, which may be a sign of credential stuffing or data theft.
Filesystem access
Supply chain riskAccesses the file system, and could potentially read sensitive data.
Found 2 instances
Long strings
Supply chain riskContains long string literals, which may be a sign of obfuscated or packed code.
URL strings
Supply chain riskPackage contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.
Fixed alerts
Long strings
Supply chain riskContains long string literals, which may be a sign of obfuscated or packed code.
URL strings
Supply chain riskPackage contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.
Improved metrics
- Total package byte prevSize
11537116
12.43%- Number of package files
1103
13.59%- Lines of code
156625
12.95%Worsened metrics
- Dependency count
99
5.32%- Dev dependency count
24
20%- Number of low supply chain risk alerts
323
3.86%- Number of medium supply chain risk alerts
64
16.36%Dependency changes
+ Added
jsonpath-rfc9535@^1.3.0+ Added
@ai-sdk/anthropic@4.0.71(transitive)+ Added
@ai-sdk/google@4.0.87(transitive)+ Added
@ai-sdk/openai@4.0.83(transitive)+ Added
@ai-sdk/xai@5.0.14(transitive)+ Added
@rolldown/binding-android-arm-eabi@1.2.12(transitive)+ Added
@rolldown/binding-android-arm64@1.2.12(transitive)+ Added
@rolldown/binding-darwin-arm64@1.2.12(transitive)+ Added
@rolldown/binding-darwin-x64@1.2.12(transitive)+ Added
@rolldown/binding-freebsd-x64@1.2.12(transitive)+ Added
@rolldown/binding-linux-arm-gnueabihf@1.2.12(transitive)+ Added
@rolldown/binding-linux-arm64-gnu@1.2.12(transitive)+ Added
@rolldown/binding-linux-arm64-musl@1.2.12(transitive)+ Added
@rolldown/binding-linux-ppc64-gnu@1.2.12(transitive)+ Added
@rolldown/binding-linux-s390x-gnu@1.2.12(transitive)+ Added
@rolldown/binding-linux-x64-gnu@1.2.12(transitive)+ Added
@rolldown/binding-linux-x64-musl@1.2.12(transitive)+ Added
@rolldown/binding-openharmony-arm64@1.2.12(transitive)+ Added
@rolldown/binding-win32-arm64-msvc@1.2.12(transitive)+ Added
@rolldown/binding-win32-x64-msvc@1.2.12(transitive)+ Added
@vercel/cli-config@0.3.1(transitive)+ Added
@vercel/cli-exec@1.0.1(transitive)+ Added
file-uri-to-path@1.0.0(transitive)+ Added
jsonpath-rfc9535@1.3.0(transitive)+ Added
minimatch@10.2.63.1.5(transitive)+ Added
minipass@7.1.3(transitive)+ Added
nopt@8.1.0(transitive)+ Added
path-scurry@2.0.2(transitive)+ Added
zod@4.1.11(transitive)- Removed
@babel/code-frame@7.29.7(transitive)- Removed
@babel/generator@7.29.8(transitive)- Removed
@babel/helper-compilation-targets@7.29.7(transitive)- Removed
@babel/helper-module-transforms@7.29.7(transitive)- Removed
@babel/helper-plugin-utils@7.29.7(transitive)- Removed
@babel/helpers@7.29.7(transitive)- Removed
@babel/template@7.29.7(transitive)- Removed
@babel/traverse@7.29.8(transitive)- Removed
@types/babel__generator@7.27.0(transitive)- Removed
@types/babel__template@7.4.4(transitive)- Removed
@types/babel__traverse@7.28.0(transitive)- Removed
@vscode/l10n@0.0.18(transitive)- Removed
convert-source-map@2.0.0(transitive)- Removed
gensync@1.0.0-beta.2(transitive)- Removed
json5@2.2.3(transitive)- Removed
lru-cache@5.1.1(transitive)- Removed
prettier@3.9.9(transitive)- Removed
request-light@0.5.8(transitive)- Removed
vscode-languageserver-types@3.17.53.18.4(transitive)- Removed
wrap-ansi@9.0.2(transitive)- Removed
yaml@2.8.3(transitive)- Removed
yaml-language-server@1.23.0(transitive)