install-files - npm Package Compare versions

Comparing version 2.0.0 to 2.0.1

package.json

 {
   "name": "install-files",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "",
@@ -5,0 +5,0 @@ "bin": "bin/install-files.js",

README.md

@@ -152,2 +152,3 @@ # install-files
 ## Release History
+* 2.0.1 Fix non-flattened npm invocation to support multiple installed versions
 * 2.0.0 Files are treated as Handlebars templates (unless `--raw` is provided).
@@ -154,0 +155,0 @@ * 1.1.4 Add yarn support ([#11](https://github.com/mixmaxhq/install-files/issues/11))

src/index.js

@@ -56,2 +56,7 @@ var Handlebars = require('handlebars');
 
+  // When this is called from a package's 'install' or 'postinstall' script, this will be the path
+  // to the root of the package that has the 'install-files' hook in its package.json. This solves
+  // problems where npm doesn't flatten install-files because of conflicting versions.
+  var invokingPackage = process.env.PWD;
+
   var npmVersion = npmv.majorVersion();
@@ -69,3 +74,12 @@
     target = fileInstallingPackagePath && hostPackageDir(fileInstallingPackagePath);
+  } else if (invokingPackage) {
+    // We know the package that's invoking us, so we just append the source directory.
+    source = path.join(invokingPackage, sourceDir);
+
+    // Get the directory of the package that hosts the invoking package. This isn't bulletproof, but
+    // it's the best guess we have.
+    target = invokingPackage && hostPackageDir(invokingPackage);
   } else {
+    // We expect PWD to be available at all times, but just in case it isn't, we fall back to
+    // previous behavior.
     source = path.join(fileInstallingPackagePath, 'node_modules', installTargetPackageName, sourceDir);
@@ -72,0 +86,0 @@ target = fileInstallingPackagePath;

New alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Fixed alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Improved metrics

Lines of code

362

3.43%

Number of lines in readme file

161

0.63%

Worsened metrics

Total package byte prevSize

22525

-43.21%

Number of package files

13

-13.33%

Number of low supply chain risk alerts

15

7.14%

No dependency changes