isolated-vm - npm Package Compare versions

Comparing version 6.0.2 to 6.1.0

scripts/run-prebuild.js

+const os = require('node:os');
+const fs = require('node:fs');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+const targetArgs = [
+  '--strip',
+  '--no-napi',
+  '--target',
+  '22.22.0',
+  '--target',
+  '24.14.0',
+];
+
+if (process.platform === 'linux') {
+  targetArgs.push('--tag-libc');
+}
+
+const env = {
+  ...process.env,
+  MAKEFLAGS: `-j${os.cpus().length}`,
+};
+
+fs.rmSync(path.join(__dirname, '..', 'prebuilds'), { recursive: true, force: true });
+
+const prebuildifyCli = require.resolve('prebuildify/bin.js');
+const result = spawnSync(process.execPath, [prebuildifyCli, ...targetArgs], { stdio: 'inherit', env });
+
+if (result.error) {
+  throw result.error;
+}
+
+process.exit(result.status ?? 1);

isolated-vm.js

@@ -1,1 +0,1 @@
-module.exports = require('./out/isolated_vm').ivm;
+module.exports = require('node-gyp-build')(__dirname).ivm;

package.json

 {
   "name": "isolated-vm",
-  "version": "6.0.2",
+  "version": "6.1.0",
   "description": "Access to multiple isolates",
@@ -11,3 +11,4 @@ "main": "isolated-vm.js",
   "scripts": {
-    "install": "prebuild-install || (node-gyp rebuild --release -j max && node-gyp clean)",
+    "install": "node-gyp-build || node-gyp rebuild --release -j max",
+    "prebuild": "node scripts/run-prebuild.js",
     "rebuild": "node-gyp rebuild --release -j max",
@@ -18,11 +19,8 @@ "lint": "find src -name '*.cc' | xargs -n1 clang-tidy",
   "dependencies": {
-    "prebuild-install": "^7.1.3"
+    "node-gyp-build": "^4.8.4"
   },
   "devDependencies": {
     "isolated-vm": ".",
-    "prebuild": "^13.0.1"
+    "prebuildify": "^6.0.1"
   },
-  "binary": {
-    "module_path": "out"
-  },
   "repository": {
@@ -29,0 +27,0 @@ "type": "git",

README.md

@@ -188,2 +188,5 @@ [![npm version](https://badgen.now.sh/npm/v/isolated-vm)](https://www.npmjs.com/package/isolated-vm)
 
+*NOTE*: `snapshot` contains compiled machine code. That means you should not accept `snapshot`
+payloads from a user, otherwise they may be able to run arbitrary code.
+
 ##### `ivm.Isolate.createSnapshot(scripts, warmup_script)`
@@ -753,3 +756,3 @@ * `scripts` *[array]*
 and where the HTML, DOM, and other web specifications begin. You should be a security-focused
-hacker, otherwise you will almost certain make a company-ending mistake. This is not a module for
+hacker, otherwise you will almost certainly make a company-ending mistake. This is not a module for
 the faint of heart. Turn back now!
@@ -756,0 +759,0 @@

New alerts

Native code

Supply chain risk

Contains native code (e.g., compiled binaries or shared libraries). Including native code can obscure malicious behavior.

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Improved metrics

Total package byte prevSize

12224844

2235.45%

Number of package files

114

12.87%

Lines of code

836

3.21%

Number of lines in readme file

779

0.39%

Worsened metrics

Number of low supply chain risk alerts

3

Infinity%

Number of medium supply chain risk alerts

16

433.33%

Dependency changes

• + Added

  node-gyp-build@^4.8.4

• + Added

  node-gyp-build@4.8.4
  (transitive)

• - Removed

  prebuild-install@^7.1.3

• - Removed

  base64-js@1.5.1
  (transitive)

• - Removed

  bl@4.1.0
  (transitive)

• - Removed

  buffer@5.7.1
  (transitive)

• - Removed

  chownr@1.1.4
  (transitive)

• - Removed

  decompress-response@6.0.0
  (transitive)

• - Removed

  deep-extend@0.6.0
  (transitive)

• - Removed

  detect-libc@2.1.2
  (transitive)

• - Removed

  end-of-stream@1.4.5
  (transitive)

• - Removed

  expand-template@2.0.3
  (transitive)

• - Removed

  fs-constants@1.0.0
  (transitive)

• - Removed

  github-from-package@0.0.0
  (transitive)

• - Removed

  ieee754@1.2.1
  (transitive)

• - Removed

  inherits@2.0.4
  (transitive)

• - Removed

  ini@1.3.8
  (transitive)

• - Removed

  mimic-response@3.1.0
  (transitive)

• - Removed

  minimist@1.2.8
  (transitive)

• - Removed

  mkdirp-classic@0.5.3
  (transitive)

• - Removed

  napi-build-utils@2.0.0
  (transitive)

• - Removed

  node-abi@3.94.0
  (transitive)

• - Removed

  once@1.4.0
  (transitive)

• - Removed

  prebuild-install@7.1.3
  (transitive)

• - Removed

  pump@3.0.4
  (transitive)

• - Removed

  rc@1.2.8
  (transitive)

• - Removed

  readable-stream@3.6.2
  (transitive)

• - Removed

  safe-buffer@5.2.1
  (transitive)

• - Removed

  semver@7.8.5
  (transitive)

• - Removed

  simple-concat@1.0.1
  (transitive)

• - Removed

  simple-get@4.0.1
  (transitive)

• - Removed

  string_decoder@1.3.0
  (transitive)

• - Removed

  strip-json-comments@2.0.1
  (transitive)

• - Removed

  tar-fs@2.1.5
  (transitive)

• - Removed

  tar-stream@2.2.0
  (transitive)

• - Removed

  tunnel-agent@0.6.0
  (transitive)

• - Removed

  util-deprecate@1.0.2
  (transitive)

• - Removed

  wrappy@1.0.2
  (transitive)