build-strap
Advanced tools
+1
-1
| { | ||
| "name": "build-strap", | ||
| "version": "5.0.4", | ||
| "version": "5.0.5", | ||
| "description": "Node scripts for building things", | ||
@@ -5,0 +5,0 @@ "license": "MIT", |
+1
-1
@@ -63,3 +63,3 @@ import fs from 'fs-extra'; | ||
| const authToken = npmAuthToken || process.env.NPM_TOKEN; | ||
| const name = getPkgName(); | ||
| const name = getPkgName(true); | ||
| const { access, dryRun, publish, registry } = npmConfig || getNpmConfig(); | ||
@@ -66,0 +66,0 @@ if (!publish) { |
+1
-0
@@ -39,1 +39,2 @@ import { CertConfig } from './cert.js'; | ||
| export declare function getPkgScope(): null | string; | ||
| export declare function getPkgSafeName(): null | string; |
+10
-0
@@ -34,1 +34,11 @@ // eslint-disable-next-line no-underscore-dangle | ||
| } | ||
| export function getPkgSafeName() { | ||
| const pkgName = getPkgName(true); | ||
| const match = pkgName.match(pkgNameRegex); | ||
| if (!match) { | ||
| return null; | ||
| } | ||
| const [, scope, name] = match; | ||
| const safeScope = scope?.slice(1); | ||
| return safeScope ? `${safeScope}-${name}` : name; | ||
| } |
+2
-2
| import fs from 'fs-extra'; | ||
| import path from 'path'; | ||
| import { npmPublish } from './npm.js'; | ||
| import { getPkgName } from './pkg.js'; | ||
| import { getPkgSafeName } from './pkg.js'; | ||
| import { buildLog, run } from './run.js'; | ||
@@ -11,3 +11,3 @@ import { tgzDir } from './tgz.js'; | ||
| const version = await getVersion(); | ||
| const name = getPkgName(); | ||
| const name = getPkgSafeName() || ''; | ||
| buildLog(`gzipping ${name} v${version.info}...`); | ||
@@ -14,0 +14,0 @@ const tgzFileName = fileName || `${name}-${version.info}.tgz`; |
+3
-4
@@ -6,3 +6,3 @@ import fs from 'fs-extra'; | ||
| import { envNpmCreds, getNpmConfig, npmGetVersions, npmWriteRc, } from './npm.js'; | ||
| import { getPkg, getPkgName } from './pkg.js'; | ||
| import { getPkg, getPkgName, getPkgSafeName } from './pkg.js'; | ||
| import { buildLog } from './run.js'; | ||
@@ -82,3 +82,2 @@ import { generateFileHash } from './tgz.js'; | ||
| const authToken = npmAuthToken || process.env.NPM_TOKEN; | ||
| const name = getPkgName(); | ||
| const { access, publish, registry } = npmConfig || getNpmConfig(); | ||
@@ -107,3 +106,3 @@ if (!publish) { | ||
| } | ||
| const existing = await npmGetVersions(name, npmPath); | ||
| const existing = await npmGetVersions(getPkgName(true), npmPath); | ||
| const { branch, isRelease, npm: npmVersion } = await getVersion(); | ||
@@ -148,3 +147,3 @@ if (existing.includes(npmVersion)) { | ||
| const version = await getVersion(); | ||
| const name = getPkgName(); | ||
| const name = getPkgSafeName(); | ||
| const filename = path.resolve(destination, `${name}-${version.npm}.tgz`); | ||
@@ -151,0 +150,0 @@ await yarn({ |
Network access
Supply chain riskThis module accesses the network.
Found 1 instance in 1 package
Shell access
Supply chain riskThis module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.
Found 1 instance in 1 package
Environment variable access
Supply chain riskPackage accesses environment variables, which may be a sign of credential stuffing or data theft.
Found 7 instances in 1 package
Filesystem access
Supply chain riskAccesses the file system, and could potentially read sensitive data.
Found 1 instance in 1 package
Long strings
Supply chain riskContains long string literals, which may be a sign of obfuscated or packed code.
Found 1 instance in 1 package
URL strings
Supply chain riskPackage contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.
Found 1 instance in 1 package
Network access
Supply chain riskThis module accesses the network.
Found 1 instance in 1 package
Shell access
Supply chain riskThis module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.
Found 1 instance in 1 package
Environment variable access
Supply chain riskPackage accesses environment variables, which may be a sign of credential stuffing or data theft.
Found 7 instances in 1 package
Filesystem access
Supply chain riskAccesses the file system, and could potentially read sensitive data.
Found 1 instance in 1 package
Long strings
Supply chain riskContains long string literals, which may be a sign of obfuscated or packed code.
Found 1 instance in 1 package
URL strings
Supply chain riskPackage contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.
Found 1 instance in 1 package
148928
0.25%3501
0.29%