cfpb-chart-builder - npm Package Compare versions

Comparing version 4.0.1 to 4.0.2

package.json

 {
   "name": "cfpb-chart-builder",
-  "version": "4.0.1",
+  "version": "4.0.2",
   "description": "Charts for the Consumer Financial Protection Bureau",
@@ -42,3 +42,3 @@ "main": "src/js/index.js",
     "highcharts": "https://github.com/cfpb/highcharts-dist#fix-missing-plotline-label",
-    "xdr": "github:contolini/xdr"
+    "xdr": "https://github.com/contolini/xdr"
   },
@@ -45,0 +45,0 @@ "devDependencies": {

New alerts

HTTP dependency

Supply chain risk

Contains a dependency which resolves to a remote HTTP URL which could be used to inject untrusted code and reduce overall package reliability.

Found 1 instance in 1 package

Manifest confusion

Supply chain risk

This package has inconsistent metadata. This could be malicious or caused by an error when publishing the package.

Found 1 instance in 1 package

Fixed alerts

GitHub dependency

Supply chain risk

Contains a dependency which resolves to a GitHub URL. Dependencies fetched from GitHub specifiers are not immutable can be used to inject untrusted code or reduce the likelihood of a reproducible install.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

4383021

increased by108.07%

Number of package files

102

increased by7.37%

Lines of code

41017

increased by29.45%

Worsened metrics

Number of low supply chain risk alerts

8

increased by100%

Number of medium supply chain risk alerts

4

increased by33.33%

Dependency changes

• Updatedxdr@https://github.com/contolini/xdr