@@ -37,6 +37,11 @@ "use strict"; | ||
| const { nxArgs } = (0, command_line_utils_1.splitArgsIntoNxArgsAndOverrides)(args, 'affected', { printWarnings: false }, (0, configuration_1.readNxJson)()); | ||
| const patterns = (await getPatterns(prettier, { ...args, ...nxArgs })).map( | ||
| // prettier removes one of the \ | ||
| // prettier-ignore | ||
| (p) => `"${p.replace(/\$/g, '\\\$')}"`); | ||
| const patterns = (await getPatterns(prettier, { ...args, ...nxArgs })).map((p) => { | ||
| // On non-Windows, escape $ to prevent shell variable interpolation | ||
| // (the shell consumes one \, so \\$ becomes \$ which the shell treats as literal $) | ||
| // On Windows (cmd.exe), $ is not a special character, so escaping it would | ||
| // cause prettier to look for a file with a literal \$ in the name | ||
| // prettier-ignore | ||
| const escaped = process.platform !== 'win32' ? p.replace(/\$/g, '\\\$') : p; | ||
| return `"${escaped}"`; | ||
| }); | ||
| // Chunkify the patterns array to prevent crashing the windows terminal | ||
@@ -208,3 +213,8 @@ const chunkList = (0, chunkify_1.chunkify)(patterns); | ||
| const { packageJson, path: packageJsonPath } = (0, package_json_1.readModulePackageJson)('prettier'); | ||
| prettierPath = path.resolve(path.dirname(packageJsonPath), packageJson.bin); | ||
| const bin = packageJson.bin; | ||
| const binPath = typeof bin === 'string' ? bin : bin?.['prettier']; | ||
| if (!binPath) { | ||
| throw new Error(`Could not find prettier binary in ${packageJsonPath}`); | ||
| } | ||
| prettierPath = path.resolve(path.dirname(packageJsonPath), binPath); | ||
| return prettierPath; | ||
@@ -211,0 +221,0 @@ } |
@@ -386,3 +386,2 @@ "use strict"; | ||
| const packagesWeMayCareAbout = {}; | ||
| // TODO (v20): Remove workaround for hiding @nrwl packages when matching @nx package is found. | ||
| for (const pkg of exports.packagesWeCareAbout) { | ||
@@ -389,0 +388,0 @@ const v = readPackageVersion(pkg); |
@@ -11,2 +11,3 @@ "use strict"; | ||
| const plugins_1 = require("../project-graph/plugins"); | ||
| const typescript_1 = require("../plugins/js/utils/typescript"); | ||
| const path_2 = require("../utils/path"); | ||
@@ -96,3 +97,3 @@ /** | ||
| exports: localProject.metadata.js.packageExports, | ||
| }, path, { conditions: ['development'] }); | ||
| }, path, { conditions: (0, typescript_1.getRootTsConfigResolveExportsConditions)() }); | ||
| if (fromExports && fromExports.length) { | ||
@@ -99,0 +100,0 @@ for (const exportPath of fromExports) { |
@@ -1,1 +0,1 @@ | ||
| "use strict";(self.webpackChunk_nx_graph_client=self.webpackChunk_nx_graph_client||[]).push([[869],{1614:()=>{}},e=>{var n;n=1614,e(e.s=n)}]); | ||
| "use strict";(self.webpackChunk_nx_graph_client=self.webpackChunk_nx_graph_client||[]).push([[869],{4074(){}},e=>{var n;n=4074,e(e.s=n)}]); |
@@ -16,2 +16,9 @@ import type * as ts from 'typescript'; | ||
| export declare function getRootTsConfigPath(): string | null; | ||
| export declare function getRootTsConfigCustomConditions(root?: string): string[]; | ||
| /** | ||
| * Conditions list for `resolve.exports`: workspace `customConditions` plus | ||
| * `development` as backward-compat for workspaces not yet migrated by | ||
| * `migrate-development-custom-condition` (21.5). | ||
| */ | ||
| export declare function getRootTsConfigResolveExportsConditions(root?: string): string[]; | ||
| export declare function findNodes(node: Node, kind: SyntaxKind | SyntaxKind[], max?: number): Node[]; |
@@ -9,2 +9,4 @@ "use strict"; | ||
| exports.getRootTsConfigPath = getRootTsConfigPath; | ||
| exports.getRootTsConfigCustomConditions = getRootTsConfigCustomConditions; | ||
| exports.getRootTsConfigResolveExportsConditions = getRootTsConfigResolveExportsConditions; | ||
| exports.findNodes = findNodes; | ||
@@ -78,2 +80,39 @@ const workspace_root_1 = require("../../../utils/workspace-root"); | ||
| } | ||
| const customConditionsCache = new Map(); | ||
| function getRootTsConfigCustomConditions(root = workspace_root_1.workspaceRoot) { | ||
| if (customConditionsCache.has(root)) { | ||
| return customConditionsCache.get(root); | ||
| } | ||
| // Resolve via the TypeScript API rather than a raw JSON read so that | ||
| // `customConditions` inherited through `extends` chains are honored — | ||
| // matches what TypeScript itself sees when resolving package exports. | ||
| let conditions = []; | ||
| for (const name of ['tsconfig.base.json', 'tsconfig.json']) { | ||
| const tsConfigPath = (0, path_1.join)(root, name); | ||
| if (!(0, fs_1.existsSync)(tsConfigPath)) { | ||
| continue; | ||
| } | ||
| try { | ||
| const options = readTsConfigOptions(tsConfigPath); | ||
| if (Array.isArray(options.customConditions)) { | ||
| conditions = options.customConditions.filter((c) => typeof c === 'string'); | ||
| } | ||
| } | ||
| catch { } | ||
| break; | ||
| } | ||
| customConditionsCache.set(root, conditions); | ||
| return conditions; | ||
| } | ||
| /** | ||
| * Conditions list for `resolve.exports`: workspace `customConditions` plus | ||
| * `development` as backward-compat for workspaces not yet migrated by | ||
| * `migrate-development-custom-condition` (21.5). | ||
| */ | ||
| function getRootTsConfigResolveExportsConditions(root = workspace_root_1.workspaceRoot) { | ||
| const conditions = getRootTsConfigCustomConditions(root); | ||
| return conditions.includes('development') | ||
| ? conditions | ||
| : [...conditions, 'development']; | ||
| } | ||
| function findNodes(node, kind, max = Infinity) { | ||
@@ -80,0 +119,0 @@ if (!node || max == 0) { |
| import type { ProjectConfiguration } from '../../config/workspace-json-project-json'; | ||
| type LocalPluginMatch = { | ||
| path: string; | ||
| projectConfig: ProjectConfiguration; | ||
| resolvedFile?: string; | ||
| }; | ||
| export declare function resolveNxPlugin(moduleName: string, root: string, paths: string[]): Promise<{ | ||
@@ -7,6 +12,3 @@ pluginPath: string; | ||
| }>; | ||
| export declare function resolveLocalNxPlugin(importPath: string, projects: Record<string, ProjectConfiguration>, root?: string): { | ||
| path: string; | ||
| projectConfig: ProjectConfiguration; | ||
| } | null; | ||
| export declare function resolveLocalNxPlugin(importPath: string, projects: Record<string, ProjectConfiguration>, root?: string): LocalPluginMatch | null; | ||
| export declare function getPluginPathAndName(moduleName: string, paths: string[], projects: Record<string, ProjectConfiguration>, root: string): { | ||
@@ -17,1 +19,2 @@ pluginPath: string; | ||
| }; | ||
| export {}; |
@@ -9,3 +9,5 @@ "use strict"; | ||
| const node_fs_1 = require("node:fs"); | ||
| const resolve_exports_1 = require("resolve.exports"); | ||
| const packages_1 = require("../../plugins/js/utils/packages"); | ||
| const typescript_1 = require("../../plugins/js/utils/typescript"); | ||
| const fileutils_1 = require("../../utils/fileutils"); | ||
@@ -17,17 +19,46 @@ const logger_1 = require("../../utils/logger"); | ||
| const retrieve_workspace_files_1 = require("../utils/retrieve-workspace-files"); | ||
| const TS_SOURCE_EXTENSIONS = new Set(['.ts', '.tsx', '.cts', '.mts']); | ||
| let projectsWithoutInference; | ||
| let projectsWithoutInferencePromise = null; | ||
| async function resolveNxPlugin(moduleName, root, paths) { | ||
| try { | ||
| require.resolve(moduleName, { paths }); | ||
| // Default plugins (see `getDefaultPlugins` in `get-plugins.ts`) are passed | ||
| // as absolute file paths to compiled bundles inside `nx` itself; they are | ||
| // never workspace-local. Skip the project load entirely for them to avoid | ||
| // recursing through `retrieveProjectConfigurationsWithoutPluginInference`, | ||
| // which itself triggers default-plugin loading. | ||
| if (!path.isAbsolute(moduleName)) { | ||
| let resolvedFromNode; | ||
| try { | ||
| resolvedFromNode = require.resolve(moduleName, { paths }); | ||
| } | ||
| catch { } | ||
| // Load projects if Node couldn't resolve (so the local fallback can run) | ||
| // OR if Node resolved to a workspace-internal path (a symlinked workspace | ||
| // package whose source-first lookup should win over the symlinked dist). | ||
| if (!resolvedFromNode || | ||
| isWorkspaceLocalResolution(resolvedFromNode, root)) { | ||
| projectsWithoutInferencePromise ??= | ||
| (0, retrieve_workspace_files_1.retrieveProjectConfigurationsWithoutPluginInference)(root); | ||
| projectsWithoutInference ??= await projectsWithoutInferencePromise; | ||
| } | ||
| } | ||
| catch { | ||
| // If a plugin cannot be resolved, we will need projects to resolve it | ||
| projectsWithoutInferencePromise ??= | ||
| (0, retrieve_workspace_files_1.retrieveProjectConfigurationsWithoutPluginInference)(root); | ||
| projectsWithoutInference ??= await projectsWithoutInferencePromise; | ||
| } | ||
| const { pluginPath, name, shouldRegisterTSTranspiler } = getPluginPathAndName(moduleName, paths, projectsWithoutInference, root); | ||
| return { pluginPath, name, shouldRegisterTSTranspiler }; | ||
| } | ||
| /** | ||
| * Distinguishes a symlinked workspace package (where `require.resolve` | ||
| * follows the package-manager symlink into the workspace source tree) from | ||
| * a truly-installed dependency under `node_modules/`. The former needs the | ||
| * source-first lookup to bypass the dist that Node would otherwise return. | ||
| */ | ||
| function isWorkspaceLocalResolution(resolvedPath, root) { | ||
| const normalizedRoot = path.normalize(root); | ||
| const normalizedPath = path.normalize(resolvedPath); | ||
| return (normalizedPath.startsWith(normalizedRoot + path.sep) && | ||
| !normalizedPath.includes(path.sep + 'node_modules' + path.sep)); | ||
| } | ||
| function isPackageResolutionError(e) { | ||
| const code = e.code; | ||
| return (code === 'MODULE_NOT_FOUND' || code === 'ERR_PACKAGE_PATH_NOT_EXPORTED'); | ||
| } | ||
| function readPluginMainFromProjectConfiguration(plugin) { | ||
@@ -51,27 +82,40 @@ const { main } = Object.values(plugin.targets).find((x) => [ | ||
| let pluginPath; | ||
| let shouldRegisterTSTranspiler = false; | ||
| try { | ||
| pluginPath = require.resolve(moduleName, { | ||
| paths, | ||
| }); | ||
| const extension = path.extname(pluginPath); | ||
| shouldRegisterTSTranspiler = extension === '.ts'; | ||
| // Resolve local workspace plugins from source first so the workspace's | ||
| // `customConditions`/`development` exports condition wins over the built | ||
| // `dist` artifact that Node's resolver would otherwise pick up via the | ||
| // `default` condition (Node ignores TypeScript custom conditions). Skipped | ||
| // when `projects` weren't loaded — the caller already determined that the | ||
| // import isn't a workspace package. | ||
| const localPlugin = projects | ||
| ? resolveLocalNxPlugin(moduleName, projects, root) | ||
| : null; | ||
| if (localPlugin) { | ||
| pluginPath = tryResolveLocalPluginFromSource(moduleName, localPlugin, root); | ||
| if (!pluginPath && getSubpathOfLocalPackage(moduleName, localPlugin)) { | ||
| throwUnresolvableLocalPluginError(moduleName, localPlugin, root); | ||
| } | ||
| } | ||
| catch (e) { | ||
| if (e.code === 'MODULE_NOT_FOUND') { | ||
| const plugin = resolveLocalNxPlugin(moduleName, projects, root); | ||
| if (plugin) { | ||
| shouldRegisterTSTranspiler = true; | ||
| const main = readPluginMainFromProjectConfiguration(plugin.projectConfig); | ||
| pluginPath = main ? path.join(root, main) : plugin.path; | ||
| if (!pluginPath) { | ||
| try { | ||
| pluginPath = require.resolve(moduleName, { paths }); | ||
| } | ||
| catch (e) { | ||
| if (localPlugin && isPackageResolutionError(e)) { | ||
| throwUnresolvableLocalPluginError(moduleName, localPlugin, root); | ||
| } | ||
| else { | ||
| logger_1.logger.error(`Plugin listed in \`nx.json\` not found: ${moduleName}`); | ||
| if (e.code !== 'MODULE_NOT_FOUND') { | ||
| throw e; | ||
| } | ||
| } | ||
| else { | ||
| if (localPlugin) { | ||
| throwUnresolvableLocalPluginError(moduleName, localPlugin, root); | ||
| } | ||
| logger_1.logger.error(`Plugin listed in \`nx.json\` not found: ${moduleName}`); | ||
| throw e; | ||
| } | ||
| } | ||
| const ext = path.extname(pluginPath); | ||
| // Directory paths fall through to Node's `package.json` `main` resolution | ||
| // which may land on a TS file; only opt out of TS transpiler registration | ||
| // when the resolved path is unambiguously JS. | ||
| const shouldRegisterTSTranspiler = ext === '' || TS_SOURCE_EXTENSIONS.has(ext); | ||
| const packageJsonPath = path.join(pluginPath, 'package.json'); | ||
@@ -84,8 +128,80 @@ const { name } = !['.ts', '.js'].some((x) => path.extname(moduleName) === x) && // Not trying to point to a ts or js file | ||
| } | ||
| function getSubpathOfLocalPackage(moduleName, plugin) { | ||
| const packageName = plugin.projectConfig.metadata?.js?.packageName; | ||
| if (!packageName || !moduleName.startsWith(packageName + '/')) { | ||
| return null; | ||
| } | ||
| return '.' + moduleName.slice(packageName.length); | ||
| } | ||
| function tryResolveLocalPluginFromSource(moduleName, plugin, root) { | ||
| if (plugin.resolvedFile) { | ||
| return plugin.resolvedFile; | ||
| } | ||
| const subpath = getSubpathOfLocalPackage(moduleName, plugin); | ||
| if (subpath) { | ||
| return resolveSubpathFromExports(plugin.projectConfig, plugin.path, subpath, root); | ||
| } | ||
| const main = readPluginMainFromProjectConfiguration(plugin.projectConfig); | ||
| return main ? path.join(root, main) : null; | ||
| } | ||
| function throwUnresolvableLocalPluginError(moduleName, plugin, root) { | ||
| const subpath = getSubpathOfLocalPackage(moduleName, plugin); | ||
| const packageName = plugin.projectConfig.metadata?.js?.packageName; | ||
| if (subpath) { | ||
| throw new Error(`Unable to resolve local plugin "${moduleName}". The import targets ` + | ||
| `the subpath "${subpath}" of the local package "${packageName}", but ` + | ||
| `the package's "exports" map has no resolvable entry for "${subpath}", ` + | ||
| `or none of the matched paths exist on disk. Check the "exports" field ` + | ||
| `in "${path.relative(root, path.join(plugin.path, 'package.json'))}" ` + | ||
| `and ensure the source file referenced by "${subpath}" exists.`); | ||
| } | ||
| throw new Error(`Unable to resolve local plugin "${moduleName}". The local package ` + | ||
| `"${packageName ?? moduleName}" does not declare a build target with ` + | ||
| `a "main" source path, and Node could not resolve it either.`); | ||
| } | ||
| function resolveSubpathFromExports(projectConfig, projectPath, subpath, root) { | ||
| const packageExports = projectConfig.metadata?.js?.packageExports; | ||
| if (!packageExports) { | ||
| return null; | ||
| } | ||
| const pkg = { | ||
| name: projectConfig.metadata.js.packageName, | ||
| exports: packageExports, | ||
| }; | ||
| try { | ||
| const matches = (0, resolve_exports_1.resolve)(pkg, subpath, { | ||
| conditions: (0, typescript_1.getRootTsConfigResolveExportsConditions)(root), | ||
| }); | ||
| if (!matches || !matches.length) { | ||
| return null; | ||
| } | ||
| for (const match of matches) { | ||
| const candidate = path.join(projectPath, match); | ||
| if ((0, node_fs_1.existsSync)(candidate)) { | ||
| return candidate; | ||
| } | ||
| } | ||
| } | ||
| catch (e) { | ||
| logger_1.logger.verbose(`Failed to resolve subpath "${subpath}" of local plugin via package.json exports`, e); | ||
| } | ||
| return null; | ||
| } | ||
| function lookupLocalPlugin(importPath, projects, root = workspace_root_1.workspaceRoot) { | ||
| const projectConfig = findNxProjectForImportPath(importPath, projects, root); | ||
| if (!projectConfig) { | ||
| const match = findNxProjectForImportPath(importPath, projects, root); | ||
| if (!match) { | ||
| return null; | ||
| } | ||
| return { path: path.join(root, projectConfig.root), projectConfig }; | ||
| let resolvedFile; | ||
| if (match.tsPathFile) { | ||
| const candidate = path.join(root, match.tsPathFile); | ||
| if (path.extname(candidate) && (0, node_fs_1.existsSync)(candidate)) { | ||
| resolvedFile = candidate; | ||
| } | ||
| } | ||
| return { | ||
| path: path.join(root, match.projectConfig.root), | ||
| projectConfig: match.projectConfig, | ||
| resolvedFile, | ||
| }; | ||
| } | ||
@@ -108,3 +224,6 @@ let packageEntryPointsToProjectMap; | ||
| if (nxProject) { | ||
| return projectNameMap.get(nxProject); | ||
| return { | ||
| projectConfig: projectNameMap.get(nxProject), | ||
| tsPathFile: tsConfigPath, | ||
| }; | ||
| } | ||
@@ -120,10 +239,10 @@ } | ||
| if (packageEntryPointsToProjectMap[importPath]) { | ||
| return packageEntryPointsToProjectMap[importPath]; | ||
| return { projectConfig: packageEntryPointsToProjectMap[importPath] }; | ||
| } | ||
| const project = (0, packages_1.matchImportToWildcardEntryPointsToProjectMap)(wildcardEntryPointsToProjectMap, importPath); | ||
| if (project) { | ||
| return project; | ||
| return { projectConfig: project }; | ||
| } | ||
| logger_1.logger.verbose('Unable to find local plugin', possibleTsPaths, projectRootMappings); | ||
| throw new Error('Unable to resolve local plugin with import path ' + importPath); | ||
| return null; | ||
| } | ||
@@ -130,0 +249,0 @@ let tsconfigPaths; |
@@ -6,5 +6,3 @@ "use strict"; | ||
| async function createNodesFromFiles(createNodes, configFiles, options, context) { | ||
| const results = []; | ||
| const errors = []; | ||
| await Promise.all(configFiles.map(async (file, idx) => { | ||
| const settled = await Promise.all(configFiles.map(async (file, idx) => { | ||
| try { | ||
@@ -15,10 +13,18 @@ const value = await createNodes(file, options, { | ||
| }, idx); | ||
| if (value) { | ||
| results.push([file, value]); | ||
| } | ||
| return value ? { kind: 'value', file, value } : { kind: 'empty' }; | ||
| } | ||
| catch (e) { | ||
| errors.push([file, e]); | ||
| return { kind: 'error', file, error: e }; | ||
| } | ||
| })); | ||
| const results = []; | ||
| const errors = []; | ||
| for (const entry of settled) { | ||
| if (entry.kind === 'value') { | ||
| results.push([entry.file, entry.value]); | ||
| } | ||
| else if (entry.kind === 'error') { | ||
| errors.push([entry.file, entry.error]); | ||
| } | ||
| } | ||
| if (errors.length > 0) { | ||
@@ -25,0 +31,0 @@ throw new error_types_1.AggregateCreateNodesError(errors, results); |
@@ -226,5 +226,5 @@ "use strict"; | ||
| canBatchTaskBeScheduled(task, batchTaskGraph) { | ||
| // task self needs to have parallelism true | ||
| // task self needs to support parallelism (undefined defaults to parallel) | ||
| // all deps have either completed or belong to the same batch | ||
| return (task.parallelism === true && | ||
| return (task.parallelism !== false && | ||
| this.taskGraph.dependencies[task.id].every((id) => this.completedTasks.has(id) || !!batchTaskGraph?.tasks[id])); | ||
@@ -252,3 +252,3 @@ } | ||
| // if all running tasks support parallelism, can only schedule task with parallelism | ||
| return this.taskGraph.tasks[taskId].parallelism === true; | ||
| return this.taskGraph.tasks[taskId].parallelism !== false; | ||
| } | ||
@@ -255,0 +255,0 @@ } |
+11
-11
| { | ||
| "name": "nx", | ||
| "version": "22.7.2", | ||
| "version": "22.7.3", | ||
| "private": false, | ||
@@ -174,12 +174,12 @@ "type": "commonjs", | ||
| "optionalDependencies": { | ||
| "@nx/nx-darwin-arm64": "22.7.2", | ||
| "@nx/nx-darwin-x64": "22.7.2", | ||
| "@nx/nx-freebsd-x64": "22.7.2", | ||
| "@nx/nx-linux-arm-gnueabihf": "22.7.2", | ||
| "@nx/nx-linux-arm64-gnu": "22.7.2", | ||
| "@nx/nx-linux-arm64-musl": "22.7.2", | ||
| "@nx/nx-linux-x64-gnu": "22.7.2", | ||
| "@nx/nx-linux-x64-musl": "22.7.2", | ||
| "@nx/nx-win32-arm64-msvc": "22.7.2", | ||
| "@nx/nx-win32-x64-msvc": "22.7.2" | ||
| "@nx/nx-darwin-arm64": "22.7.3", | ||
| "@nx/nx-darwin-x64": "22.7.3", | ||
| "@nx/nx-freebsd-x64": "22.7.3", | ||
| "@nx/nx-linux-arm-gnueabihf": "22.7.3", | ||
| "@nx/nx-linux-arm64-gnu": "22.7.3", | ||
| "@nx/nx-linux-arm64-musl": "22.7.3", | ||
| "@nx/nx-linux-x64-gnu": "22.7.3", | ||
| "@nx/nx-linux-x64-musl": "22.7.3", | ||
| "@nx/nx-win32-arm64-msvc": "22.7.3", | ||
| "@nx/nx-win32-x64-msvc": "22.7.3" | ||
| }, | ||
@@ -186,0 +186,0 @@ "nx-migrations": { |
Sorry, the diff of this file is too big to display
Sorry, the diff of this file is not supported yet
Sorry, the diff of this file is not supported yet
Network access
Supply chain riskThis module accesses the network.
Found 2 instances in 1 package
Shell access
Supply chain riskThis module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.
Found 1 instance in 1 package
Uses eval
Supply chain riskPackage uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.
Found 1 instance in 1 package
Debug access
Supply chain riskUses debug, reflection and dynamic code execution features.
Found 3 instances in 1 package
Dynamic require
Supply chain riskDynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.
Found 1 instance in 1 package
Environment variable access
Supply chain riskPackage accesses environment variables, which may be a sign of credential stuffing or data theft.
Found 145 instances in 1 package
Filesystem access
Supply chain riskAccesses the file system, and could potentially read sensitive data.
Found 2 instances in 1 package
AI-detected potential code anomaly
Supply chain riskAI has identified unusual behaviors that may pose a security risk.
Found 2 instances in 1 package
Long strings
Supply chain riskContains long string literals, which may be a sign of obfuscated or packed code.
Found 1 instance in 1 package
URL strings
Supply chain riskPackage contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.
Found 1 instance in 1 package
Network access
Supply chain riskThis module accesses the network.
Found 2 instances in 1 package
Shell access
Supply chain riskThis module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.
Found 1 instance in 1 package
Uses eval
Supply chain riskPackage uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.
Found 1 instance in 1 package
Debug access
Supply chain riskUses debug, reflection and dynamic code execution features.
Found 3 instances in 1 package
Dynamic require
Supply chain riskDynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.
Found 1 instance in 1 package
Environment variable access
Supply chain riskPackage accesses environment variables, which may be a sign of credential stuffing or data theft.
Found 145 instances in 1 package
Filesystem access
Supply chain riskAccesses the file system, and could potentially read sensitive data.
Found 2 instances in 1 package
AI-detected potential code anomaly
Supply chain riskAI has identified unusual behaviors that may pose a security risk.
Found 2 instances in 1 package
Long strings
Supply chain riskContains long string literals, which may be a sign of obfuscated or packed code.
Found 1 instance in 1 package
URL strings
Supply chain riskPackage contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.
Found 1 instance in 1 package
16021901
0.05%85025
0.22%721
0.28%