json-fix - npm Package Compare versions

Comparing version 0.2.0 to 0.3.0

index.js

 #!/usr/bin/env node
 
 var fs = require("fs");
+var jsonic = require("jsonic");
 var program = require("commander");
@@ -23,5 +24,5 @@ var packagejson = require("./package.json");
     var str = fs.readFileSync(path).toString();
-    eval("var js = " + str);
-    var json = JSON.stringify(js, null, spaces);
+    var js = jsonic(str);
+    var json = JSON.stringify(js, null, spaces) + "\n";
     fs.writeFileSync(path, json);
 }

package.json

 {
   "name": "json-fix",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "",
@@ -23,4 +23,5 @@ "main": "index.js",
   "dependencies": {
-    "commander": "^2.12.2"
+    "commander": "^2.12.2",
+    "jsonic": "^0.3.0"
   }
 }

Fixed alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1637

increased by3.8%

Lines of code

22

increased by4.76%

Number of medium supply chain risk alerts

0

decreased by-100%

Worsened metrics

Dependency count

2

increased by100%

Dependency changes

• + Addedjsonic@^0.3.0

• + Addedjsonic@0.3.1(transitive)