web-worker - npm Package Compare versions

Comparing version 1.4.1 to 1.5.0

package.json

 {
   "name": "web-worker",
-  "version": "1.4.1",
+  "version": "1.5.0",
   "description": "Consistent Web Workers in browser and Node.",
@@ -5,0 +5,0 @@ "main": "./dist/browser/index.cjs",

src/node/index.js

@@ -17,3 +17,5 @@ /**
 
-import URL, { fileURLToPath } from 'node:url';
+import { URL, fileURLToPath, pathToFileURL } from 'url';
+import path from 'path';
+import fs from 'fs';
 import VM from 'vm';
@@ -74,5 +76,5 @@ import threads from 'worker_threads';
 // thread boundary, but behaves differently in each context.
-export default threads.isMainThread ? mainThread() : workerThread();
+export default typeof Worker === 'function' ? Worker : threads.isMainThread ? mainThread() : workerThread();
 
-const baseUrl = URL.pathToFileURL(process.cwd() + '/');
+const baseUrl = pathToFileURL(process.cwd() + '/');
 
@@ -103,3 +105,3 @@ function mainThread() {
 			else {
-				mod = URL.fileURLToPath(new URL.URL(url, baseUrl));
+				mod = fileURLToPath(new URL(url, baseUrl));
 			}
@@ -138,2 +140,6 @@ const worker = new threads.Worker(
 function workerThread() {
+	// loaded in a real Web Worker (eg: on Electron)
+	if (typeof global.WorkerGlobalScope === 'function') {
+		return;
+	}
 	let { mod, name, type } = threads.workerData;
@@ -171,2 +177,18 @@ if (!mod) return mainThread();
 		}
+		importScripts() {
+			for (let i = 0; i < arguments.length; i++) {
+				const url = arguments[i];
+				let code;
+				if (/^data:/.test(url)) {
+					code = parseDataUrl(url).data;
+				}
+				else {
+					code = fs.readFileSync(
+						new URL(path.posix.normalize(url), pathToFileURL(mod)),
+						'utf-8'
+					);
+				}
+				VM.runInThisContext(code, { filename: url });
+			}
+		}
 	}
@@ -181,6 +203,7 @@ let proto = Object.getPrototypeOf(global);
 	global.name = name;
+	global.WorkerGlobalScope = WorkerGlobalScope;
 
 	const isDataUrl = /^data:/.test(mod);
 	if (type === 'module') {
-		import(isDataUrl ? mod : URL.pathToFileURL(mod))
+		import(isDataUrl ? mod : pathToFileURL(mod))
 			.catch(err => {
@@ -201,3 +224,3 @@ if (isDataUrl && err.message === 'Not supported') {
 			else {
-				require(mod);
+				global.importScripts(mod);
 			}
@@ -222,2 +245,3 @@ }
 	if (!m) throw Error('Invalid Data URL.');
+	data = decodeURIComponent(data);
 	if (encoding) switch (encoding.toLowerCase()) {
@@ -224,0 +248,0 @@ case 'base64':

New alerts

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Fixed alerts

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

31056

increased by3.31%

Lines of code

416

increased by8.05%

Number of low supply chain risk alerts

5

decreased by-28.57%

No dependency changes