lego-bigpipe - npm Package Compare versions

Comparing version 0.1.5 to 0.1.6

index.js

 'use strict';
 
-var vm = require('vm');
 var ejs = require('ejs');
@@ -34,6 +33,6 @@ var tpl = {
   if (data.source && data.data) {
-    var sandbox = {module: {}};
-    var code = 'var exports=module.exports={};' + data.data;
-    vm.runInNewContext(code, sandbox);
-    pagelet.html = ejs.render(data.source, {locals: sandbox.module.exports});
+    var module = {exports: {}};
+    /*jshint evil: true */
+    (new Function('module', data.data))(module);
+    pagelet.html = ejs.render(data.source, {locals: module.exports});
   } else if (data.source) {
@@ -40,0 +39,0 @@ pagelet.html = data.source;

package.json

 {
   "name": "lego-bigpipe",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "a bigpipe builder for scrat-lego",
@@ -5,0 +5,0 @@ "license": "MIT",

New alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Fixed alerts

Debug access

Supply chain risk

Uses debug, reflection and dynamic code execution features.

Found 1 instance in 1 package

Improved metrics

Number of low supply chain risk alerts

0

decreased by-100%

Worsened metrics

Total package byte prevSize

11976

decreased by-0.47%

Lines of code

328

decreased by-0.3%

Number of medium supply chain risk alerts

1

increased byInfinity%

No dependency changes