deploy-finlean - npm Package Compare versions

Comparing version 1.0.3 to 1.0.4

index.js

@@ -5,3 +5,3 @@ /*
  * @LastEditors: zhaoxiaoqiang1 [e-mail]
- * @LastEditTime: 2026-03-20 16:06:16
+ * @LastEditTime: 2026-03-20 16:12:19
  * @FilePath: \deploy-package\index.js
@@ -30,6 +30,17 @@ * @Description: 这是默认设置,请设置`customMade`, 打开koroFileHeader查看配置 进行设置: https://github.com/OBKoro1/koro1FileHeader/wiki/%E9%85%8D%E7%BD%AE
     
-    // 将Windows路径转换为file:// URL
-    const configUrl = `file://${configPath.replace(/\\/g, '/')}`;
-    const configModule = await import(configUrl);
-    const config = configModule.default;
+    // 读取配置文件内容
+    const configContent = fs.readFileSync(configPath, 'utf8');
+    // 移除可能的BOM字符
+    const cleanContent = configContent.replace(/^\ufeff/, '');
+    
+    // 解析配置文件
+    let config;
+    try {
+      // 尝试使用ES模块语法解析
+      const moduleCode = `(function() { ${cleanContent.replace('export default', 'return')} })()`;
+      config = eval(moduleCode);
+    } catch (error) {
+      console.error('Error parsing config file:', error);
+      process.exit(1);
+    }
     console.log('配置文件读取完成');
@@ -36,0 +47,0 @@

package.json

 {
   "name": "deploy-finlean",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "Deployment package for projects",
@@ -5,0 +5,0 @@ "main": "index.js",

New alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Improved metrics

Total package byte prevSize

11210

3.02%

Lines of code

184

5.75%

Worsened metrics

Number of medium supply chain risk alerts

2

100%

No dependency changes