get-pkg - npm Package Compare versions

Comparing version 1.0.0 to 1.0.1

index.js

@@ -10,3 +10,3 @@ /*!
 
-const request = require('axios');
+const axios = require('axios');
 
@@ -26,15 +26,29 @@ module.exports = function getPkg(name, version, cb) {
 
-  const promise = request.get(`https://registry.npmjs.org/${name}/${version}`)
-    .then(res => res.data)
+  function request(url) {
+    return axios.get(`${url}/${name}/${version}`)
+      .then(res => res.data)
+      .catch(err => {
+        if (err.response.status === 500) {
+          return Promise.reject(new Error(err.response.status));
+        }
+        if (err.response.status === 404) {
+          const error = new Error('document not found');
+          error.code = err.response.status;
+          error.pkgName = name;
+          return Promise.reject(error);
+        }
+        return Promise.reject(err);
+      });
+  }
+
+  // the following code hits the yarn CNAME (they call it a "proxy")
+  // when npm's registry fails. In practice, this usually won't make a
+  // difference since yarn is pseudo-proxying npm's registry in the
+  // first place, but in the case of CDN failure, it might help.
+  const promise = request('https://registry.npmjs.org')
     .catch(err => {
-      if (err.response.status === 500) {
-        return Promise.reject(new Error(err.response.status));
-      }
-      if (err.response.status === 404) {
-        const error = new Error('document not found');
-        error.code = err.response.status;
-        error.pkgName = name;
-        return Promise.reject(error);
-      }
-      return Promise.reject(err);
+      return request('https://registry.yarnpkg.com')
+        .catch(() => {
+          return Promise.reject(err);
+        })
     });
@@ -41,0 +55,0 @@

package.json

 {
   "name": "get-pkg",
   "description": "Get the package.json for a project from npm.",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "homepage": "https://github.com/jonschlinkert/get-pkg",
@@ -6,0 +6,0 @@ "author": "Jon Schlinkert (https://github.com/jonschlinkert)",

Fixed alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

7355

7.42%

Lines of code

55

30.95%

Number of low supply chain risk alerts

1

-50%

No dependency changes