tempmail.js - npm Package Compare versions

Comparing version 0.2.1 to 0.3.0

bower.json

 {
   "name": "tempmail.js",
-  "main": "dist/tempmail.js",
-  "version": "0.2.1",
+  "main": "dist/tempmail.min.js",
+  "version": "0.3.0",
   "homepage": "https://github.com/mileszim/tempmail.js",
   "authors": [
-    "Miles Zimmerman <[e-mail]>"
+    "Miles Zimmerman <[e-mail]>"
   ],
@@ -9,0 +9,0 @@ "description": "Programatically generate and receive mail from temporary email addresses. Works in browsers and in node.js.",

package.json

 {
   "name": "tempmail.js",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Programatically generate and receive mail from temporary email addresses. Works in browsers and in node.js.",
-  "main": "dist/tempmail-node.js",
+  "main": "dist/tempmail.node.js",
   "scripts": {
+    "build": "BABEL_ENV=node node_modules/.bin/webpack",
+    "clean": "rm dist/*",
     "test": "echo \"Error: no test specified\" && exit 1"
@@ -28,20 +30,15 @@ },
   "dependencies": {
-    "blueimp-md5": "^2.3.0",
-    "fetch-jsonp": "^1.0.0",
-    "isomorphic-fetch": "^2.2.1",
-    "babel-polyfill": "^6.7.2"
+    "chance": "^1.0.13",
+    "fetch-jsonp": "^1.1.3",
+    "isomorphic-fetch": "^2.2.1"
   },
   "devDependencies": {
-    "babel-plugin-syntax-async-functions": "^6.5.0",
-    "babel-plugin-transform-regenerator": "^6.6.5",
-    "babel-preset-es2015": "^6.6.0",
-    "babel-preset-es2015-rollup": "^1.1.1",
-    "babelify": "^7.2.0",
-    "grunt": "^0.4.5",
-    "grunt-babel": "^6.0.0",
-    "grunt-browserify": "^5.0.0",
-    "grunt-contrib-uglify": "^1.0.0",
-    "grunt-rollup": "^0.6.2",
-    "rollup-plugin-babel": "^2.4.0"
+    "babel-cli": "^6.0.0",
+    "babel-core": "^6.0.0",
+    "babel-loader": "^7.1.2",
+    "babel-minify-webpack-plugin": "^0.3.0",
+    "babel-preset-env": "^1.6.1",
+    "clean-webpack-plugin": "^0.1.18",
+    "webpack": "^3.10.0"
   }
 }

src/index.js

@@ -1,4 +0,1 @@
-import 'babel-polyfill';
-
-import md5 from 'blueimp-md5';
 import 'isomorphic-fetch';
@@ -8,3 +5,10 @@ import 'fetch-jsonp';
 import { IS_NODE } from './constants';
-import { formatMessage, randomEmail, inboxURL, domainsURL, deleteMessageURL } from './utils';
+import {
+  formatMessage,
+  emailId,
+  randomEmail,
+  inboxURL,
+  domainsURL,
+  deleteMessageURL
+} from './utils';
 
@@ -19,3 +23,3 @@
     this.address    = address || randomEmail();
-    this.address_id = md5(this.address);
+    this.address_id = emailId(this.address);
     this.fetch      = IS_NODE ? fetch : fetchJsonp;
@@ -22,0 +26,0 @@ }

src/utils.js

@@ -1,3 +0,10 @@
-import md5 from 'blueimp-md5';
-import { ADDRESS_DOMAINS, API_BASE, API_FORMAT, ENDPOINT_INBOX, ENDPOINT_DOMAINS, ENDPOINT_DELETE } from './constants';
+import chance from 'chance';
+import {
+  ADDRESS_DOMAINS,
+  API_BASE,
+  API_FORMAT,
+  ENDPOINT_INBOX,
+  ENDPOINT_DOMAINS,
+  ENDPOINT_DELETE
+} from './constants';
 
@@ -29,4 +36,6 @@
 export function randomEmail() {
-  var prefix = md5(Math.random() + Date() + Math.random());
-  var suffix = ADDRESS_DOMAINS[Math.floor(Math.random() * ADDRESS_DOMAINS.length)];
+  const name = chance.name({ middle_initial: true }).toLowerCase().split(' ').join('.');
+  const year = chance.integer({ min: 1970, max: ((new Date()).getFullYear() - 8) });
+  const prefix = `${name}-${year}`;
+  const suffix = chance.pickone(ADDRESS_DOMAINS);
   return prefix + '@' + suffix;
@@ -37,2 +46,12 @@ }
 /**
+ * Gives same ID for email address
+ * @returns {string} ID
+ */
+export function emailId(emailAddress) {
+  let code = emailAddress.split("").map(c => c.codePointAt(0)).join("");
+  return parseInt(code).toString(16).substr(2,12);
+}
+
+
+/**
  * Assemble API url
@@ -39,0 +58,0 @@ * @param   {string} endpoint

Fixed alerts

Uses eval

Supply chain risk

Package uses eval() which is a dangerous function. This prevents the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Minified code

Quality

This package contains minified code. This may be harmless in some cases where minified code is included in packaged libraries, however packages on npm should not minify code.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1134423

increased by165.04%

Dependency count

3

decreased by-25%

Dev dependency count

7

decreased by-36.36%

Lines of code

20257

increased by157.07%

Number of low quality alerts

2

decreased by-33.33%

Number of low supply chain risk alerts

0

decreased by-100%

Number of medium supply chain risk alerts

4

decreased by-66.67%

Dependency changes

• + Addedchance@^1.0.13

• + Addedchance@1.1.11(transitive)

• - Removedbabel-polyfill@^6.7.2

• - Removedblueimp-md5@^2.3.0

• - Removedbabel-polyfill@6.26.0(transitive)

• - Removedbabel-runtime@6.26.0(transitive)

• - Removedblueimp-md5@2.19.0(transitive)

• - Removedcore-js@2.6.12(transitive)

• - Removedregenerator-runtime@0.10.50.11.1(transitive)

• Updatedfetch-jsonp@^1.1.3