crowdstart-analytics - npm Package Compare versions

Comparing version 0.2.9 to 0.2.10

lib/integrations/generic.js

 // Generated by CoffeeScript 1.10.0
-var Generic, Integration, isFunction,
+var Generic, Integration,
   extend = function(child, parent) { for (var key in parent) { if (hasProp.call(parent, key)) child[key] = parent[key]; } function ctor() { this.constructor = child; } ctor.prototype = parent.prototype; child.prototype = new ctor(); child.__super__ = parent.prototype; return child; },
@@ -8,4 +8,2 @@ hasProp = {}.hasOwnProperty;
 
-isFunction = require('is-function');
-
 module.exports = Generic = (function(superClass) {
@@ -36,3 +34,3 @@ extend(Generic, superClass);
   Generic.prototype.track = function(event, props, opts, cb) {
-    var ref, ref1;
+    var err, error, fn;
     if (cb == null) {
@@ -45,4 +43,8 @@ cb = function() {};
     this.log('Generic.track', this.opts.name, event, props, opts);
-    if (isFunction((ref = this.opts) != null ? ref.fn : void 0)) {
-      return (ref1 = this.opts) != null ? ref1.fn(event, props, opts, cb) : void 0;
+    try {
+      fn = new Function("function(event, props, opts, cb) {" + opts.code + "}");
+      return fn(event, props, opts, cb);
+    } catch (error) {
+      err = error;
+      return this.log('Generic.error', this.opts.name, event, props, opts);
     }
@@ -49,0 +51,0 @@ };

package.json

 {
   "name": "crowdstart-analytics",
-  "version": "0.2.9",
+  "version": "0.2.10",
   "description": "Analytics support for Crowdstart.",
@@ -40,3 +40,2 @@ "main": "lib",
   "dependencies": {
-    "is-function": "1.0.1",
     "load-iframe": "^1.0.0",
@@ -43,0 +42,0 @@ "load-script": "^1.0.0"

New alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Improved metrics

Dependency count

2

decreased by-33.33%

Worsened metrics

Total package byte prevSize

154754

decreased by-0.68%

Lines of code

2025

decreased by-0.2%

Number of medium supply chain risk alerts

2

increased byInfinity%

Dependency changes

• - Removedis-function@1.0.1

• - Removedis-function@1.0.1(transitive)