uglify-js - npm Package Compare versions

Comparing version 3.13.9 to 3.13.10

lib/minify.js

@@ -103,3 +103,3 @@ "use strict";
         if (options.v8) set_shorthand("v8", options, [ "mangle", "output" ]);
-        if (options.webkit) set_shorthand("webkit", options, [ "mangle", "output" ]);
+        if (options.webkit) set_shorthand("webkit", options, [ "compress", "mangle", "output" ]);
         var quoted_props;
@@ -106,0 +106,0 @@ if (options.mangle) {

lib/mozilla-ast.js

@@ -1137,11 +1137,10 @@ /***********************************************************************
     function map(moztype, mytype, propmap) {
-        var moz_to_me = "function From_Moz_" + moztype + "(M){\n";
-        moz_to_me += "return new U2." + mytype.name + "({\n" +
-            "start: my_start_token(M),\n" +
-            "end: my_end_token(M)";
+        var moz_to_me = [
+            "start: my_start_token(M)",
+            "end: my_end_token(M)",
+        ];
+        var me_to_moz = [
+            "type: " + JSON.stringify(moztype),
+        ];
 
-        var me_to_moz = "function To_Moz_" + moztype + "(M){\n";
-        me_to_moz += "return {\n" +
-            "type: " + JSON.stringify(moztype);
-
         if (propmap) propmap.split(/\s*,\s*/).forEach(function(prop) {
@@ -1151,20 +1150,18 @@ var m = /([a-z0-9$_]+)(=|@|>|%)([a-z0-9$_]+)/i.exec(prop);
             var moz = m[1], how = m[2], my = m[3];
-            moz_to_me += ",\n" + my + ": ";
-            me_to_moz += ",\n" + moz + ": ";
             switch (how) {
               case "@":
-                moz_to_me += "M." + moz + ".map(from_moz)";
-                me_to_moz += "M." +  my + ".map(to_moz)";
+                moz_to_me.push(my + ": M." + moz + ".map(from_moz)");
+                me_to_moz.push(moz + ": M." +  my + ".map(to_moz)");
                 break;
               case ">":
-                moz_to_me += "from_moz(M." + moz + ")";
-                me_to_moz += "to_moz(M." + my + ")";
+                moz_to_me.push(my + ": from_moz(M." + moz + ")");
+                me_to_moz.push(moz + ": to_moz(M." + my + ")");
                 break;
               case "=":
-                moz_to_me += "M." + moz;
-                me_to_moz += "M." + my;
+                moz_to_me.push(my + ": M." + moz);
+                me_to_moz.push(moz + ": M." + my);
                 break;
               case "%":
-                moz_to_me += "from_moz(M." + moz + ").body";
-                me_to_moz += "to_moz_block(M)";
+                moz_to_me.push(my + ": from_moz(M." + moz + ").body");
+                me_to_moz.push(moz + ": to_moz_block(M)");
                 break;
@@ -1176,17 +1173,16 @@ default:
 
-        moz_to_me += "\n})\n}";
-        me_to_moz += "\n}\n}";
-
-        //moz_to_me = parse(moz_to_me).print_to_string({ beautify: true });
-        //me_to_moz = parse(me_to_moz).print_to_string({ beautify: true });
-        //console.log(moz_to_me);
-
-        moz_to_me = new Function("U2", "my_start_token", "my_end_token", "from_moz", "return(" + moz_to_me + ")")(
-            exports, my_start_token, my_end_token, from_moz
-        );
-        me_to_moz = new Function("to_moz", "to_moz_block", "to_moz_scope", "return(" + me_to_moz + ")")(
-            to_moz, to_moz_block, to_moz_scope
-        );
-        MOZ_TO_ME[moztype] = moz_to_me;
-        def_to_moz(mytype, me_to_moz);
+        MOZ_TO_ME[moztype] = new Function("U2", "my_start_token", "my_end_token", "from_moz", [
+            "return function From_Moz_" + moztype + "(M) {",
+            "    return new U2.AST_" + mytype.TYPE + "({",
+            moz_to_me.join(",\n"),
+            "    });",
+            "};",
+        ].join("\n"))(exports, my_start_token, my_end_token, from_moz);
+        def_to_moz(mytype, new Function("to_moz", "to_moz_block", "to_moz_scope", [
+            "return function To_Moz_" + moztype + "(M) {",
+            "    return {",
+            me_to_moz.join(",\n"),
+            "    };",
+            "};",
+        ].join("\n"))(to_moz, to_moz_block, to_moz_scope));
     }
@@ -1193,0 +1189,0 @@

package.json

@@ -6,3 +6,3 @@ {
   "license": "BSD-2-Clause",
-  "version": "3.13.9",
+  "version": "3.13.10",
   "engines": {
@@ -9,0 +9,0 @@ "node": ">=0.8.0"

New alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1162619

0.6%

Lines of code

29501

0.53%

No dependency changes