nopt - npm Package Compare versions

Comparing version 2.2.0 to 2.2.1

lib/nopt.js

@@ -129,2 +129,7 @@ // info about each config option.
   if (val === true) return false
+  val = String(val)
+  var homePattern = process.platform === 'win32' ? /^~(\/|\\)/ : /^~\//
+  if (val.match(homePattern) && process.env.HOME) {
+    val = path.resolve(process.env.HOME, val.substr(2))
+  }
   data[k] = path.resolve(String(val))
@@ -131,0 +136,0 @@ return true

package.json

 {
   "name": "nopt",
-  "version": "2.2.0",
+  "version": "2.2.1",
   "description": "Option parsing for Node, supporting types, shorthands, etc. Used by npm.",
@@ -5,0 +5,0 @@ "author": "Isaac Z. Schlueter <[e-mail]> (http://blog.izs.me/)",

test/basic.js

@@ -18,2 +18,10 @@ var nopt = require("../")
 
+test("~ path is resolved to $HOME", function (t) {
+  var path = require("path")
+  if (!process.env.HOME) process.env.HOME = "/tmp"
+  var parsed = nopt({key: path}, {}, ["--key=~/val"], 0)
+  t.same(parsed.key, path.resolve(process.env.HOME, "val"))
+  t.end()
+})
+
 test("other tests", function (t) {
@@ -20,0 +28,0 @@

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

30346

1.56%

Lines of code

663

1.84%

Worsened metrics

Number of low supply chain risk alerts

8

166.67%

No dependency changes