sri - npm Package Compare versions

Comparing version 1.0.0 to 1.1.0

index.js

@@ -1,21 +0,20 @@
-const path = require('path');
-const exec = require('child_process').exec;
+const crypto = require('crypto');
 
-function getSRIHash(filePath) {
+const algorithm = 'sha384';
 
-  return new Promise(function(resolve, reject) {
+function getSRIString(data) {
+  return getIntegrity(algorithm, getSRIHash(data));
+}
 
-    exec(getCommand(filePath), function(err, stdout, stderr) {
-
-        if (err) { reject(err); }
-        else { resolve(stdout); }
-    });
-  });
+function getIntegrity(algorithm, hash) {
+  return `${algorithm}-${hash}`;
 }
 
-function getCommand(filePath) {
-
-  return `cat ${path.join(__dirname, filePath)} | openssl dgst -sha384 -binary | openssl enc -base64 -A`
+function getSRIHash(data) {
+  return crypto
+    .createHash(algorithm)
+    .update(data, 'utf8')
+    .digest('base64');
 }
 
-module.exports = getSRIHash;
+module.exports = { getSRIString };

package.json

 {
   "name": "sri",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Subresource Integrity hash generator",
@@ -5,0 +5,0 @@ "main": "index.js",

README.md

@@ -16,7 +16,5 @@ # sri
 ```javascript
-const getSRIHash = require('sri');
+const sri = require('sri');
 
-getSRIHash('file.js')
-  .then((hash) => console.log(hash))
-  .catch((error) => console.error(error));
+const sriString = sri.getSRIString('file.js'); // sha384-J5Dqvq3...
 ```

test/index.js

@@ -1,14 +0,16 @@
-const getSRIHash = require('../index');
+const sri = require('../index');
+const fs = require('fs');
+const path = require('path');
 
-const expected = 'bFHdtDIrMJABoPy41E4hepGKnrLYuQ60YjPufbnrIQFU0da1u62PDdnK+aVeB3gr';
+const expected = 'sha384-J5Dqvq3qATcLhtSkdquOAC/pjNfj8c+oSP55YxlmhCRpAmMfdBuTMJZodkLMhw2r';
 
-getSRIHash('./index.js')
-  .then(function(hash) {
+fs.readFile(path.join(__dirname, '../index.js'), 'utf8', function(err, data) {
 
-    if (hash !== expected) {
-      throw Error(`Wrong hash: ${hash}`);
-    } else {
-      console.log(`Passed: ${hash}`);
-    }
-  })
-  .catch(function(err) { console.log(err); });
+  const sriString = sri.getSRIString(data);
+
+  if (sriString !== expected) {
+    throw Error(`Wrong hash: ${sriString}`);
+  } else {
+    console.log(`Passed: ${sriString}`);
+  }
+});

New alerts

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Fixed alerts

Obfuscated code

Supply chain risk

Obfuscated files are intentionally packed to hide their behavior. This could be a sign of malware.

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Improved metrics

Lines of code

27

8%

Number of high supply chain risk alerts

0

-100%

Number of medium supply chain risk alerts

0

-100%

Worsened metrics

Total package byte prevSize

2455

-1.88%

Number of lines in readme file

20

-9.09%

Number of low supply chain risk alerts

2

100%

No dependency changes