marshmallows - npm Package Compare versions

Comparing version 0.1.1 to 1.0.0

index.js

 'use strict';
 const auth = require('basic-auth');
 
+function processIsConfigured(proc) {
+  return !!proc.env.NODE_ENV &&
+    proc.env.NODE_ENV !== 'development' &&
+    !!proc.env.USER &&
+    !!proc.env.PASS;
+}
+
 /**
@@ -16,3 +23,3 @@ * auth
 function authHandler(req, res, next) {
-  if (!!process.env.NODE_ENV && process.env.NODE_ENV !== 'development') {
+  if (processIsConfigured(process)) {
     const user = auth(req);
@@ -19,0 +26,0 @@

package.json

 {
   "name": "marshmallows",
-  "version": "0.1.1",
+  "version": "1.0.0",
   "description": "A drop-in Basic Auth middleware for Express",
@@ -5,0 +5,0 @@ "main": "index.js",

New alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Fixed alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

No v1

Quality

Package is not semver >=1. This means it is not stable and does not support ^ ranges.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1673

increased by7.94%

Lines of code

31

increased by24%

Number of low quality alerts

2

decreased by-33.33%

Number of low supply chain risk alerts

2

decreased by-50%

Worsened metrics

Number of medium supply chain risk alerts

1

increased byInfinity%

No dependency changes