which - npm Package Compare versions

Comparing version 1.1.0 to 1.1.1

package.json

@@ -5,3 +5,3 @@ {
   "description": "Like which(1) unix command. Find the first instance of an executable in the PATH.",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "repository": {
@@ -8,0 +8,0 @@ "type": "git",

README.md

@@ -1,5 +0,34 @@
-The "which" util from npm's guts.
+# which
 
+Like the unix `which` utility.
+
 Finds the first instance of a specified executable in the PATH
 environment variable.  Does not cache the results, so `hash -r` is not
 needed when the PATH changes.
+
+## USAGE
+
+```javascript
+var which = require('which')
+
+// async usage
+which('node', function (er, resolvedPath) {
+  // er is returned if no "node" is found on the PATH
+  // if it is found, then the absolute path to the exec is returned
+})
+
+// sync usage
+// throws if not found
+var resolved = which.sync('node')
+
+// Pass options to override the PATH and PATHEXT environment vars.
+which('node', { path: someOtherPath }, function (er, resolved) {
+  if (er)
+    throw er
+  console.log('found at %j', resolved)
+})
+```
+
+## OPTIONS
+
+If you pass in options, then `path` and `pathExt` are relevant.

test/basic.js

@@ -9,5 +9,8 @@ var t = require('tap')
 
-var win32 = process.platform === 'win32'
-var skip = { skip: win32 ? 'not relevant on windows' : false }
+var isWindows = process.platform === 'win32' ||
+    process.env.OSTYPE === 'cygwin' ||
+    process.env.OSTYPE === 'msys'
 
+var skip = { skip: isWindows ? 'not relevant on windows' : false }
+
 t.test('setup', function (t) {
@@ -53,3 +56,3 @@ rimraf.sync(fixture)
   t.plan(2)
-  var opt = { pathExt: [ '.sh' ] }
+  var opt = { pathExt: '.sh' }
   var expect = path.resolve(fixture, 'foo.sh').toLowerCase()
@@ -56,0 +59,0 @@

which.js

 module.exports = which
 which.sync = whichSync
 
-var path = require("path")
-var COLON = process.platform === "win32" ? ";" : ":"
+var isWindows = process.platform === 'win32' ||
+    process.env.OSTYPE === 'cygwin' ||
+    process.env.OSTYPE === 'msys'
+
+var path = require('path')
+var COLON = isWindows ? ';' : ':'
 var isExe
-var fs = require("fs")
+var fs = require('fs')
 var isAbsolute = require('is-absolute')
 
-if (process.platform == "win32") {
+if (isWindows) {
   // On windows, there is no good way to check that a file is executable
@@ -19,2 +23,11 @@ isExe = function isExe () { return true }
         || (mod & 0110) && process.getuid && 0   === process.getuid()
+
+    if (process.getgroups && (mod & 0010)) {
+      var groups = process.getgroups()
+      for (var g = 0; g < groups.length; g++) {
+        if (groups[g] === gid)
+          return true
+      }
+    }
+
     return ret
@@ -31,19 +44,32 @@ }
   var colon = opt.colon || COLON
-  var pathEnv = (opt.path || process.env.PATH || "").split(colon)
-  var pathExt = [""]
+  var pathEnv = opt.path || process.env.PATH || ''
+  var pathExt = ['']
 
-  if (process.platform === "win32") {
-    pathEnv.push(process.cwd())
-    pathExt = opt.pathExt || (process.env.PATHEXT || ".EXE").split(colon)
-    if (cmd.indexOf(".") !== -1)
-      pathExt.unshift("")
+  // On windows, env.Path is common.
+  if (isWindows && !pathEnv) {
+    var k = Object.keys(process.env)
+    for (var p = 0; p < k.length; p++) {
+      if (p.toLowerCase() === 'path') {
+        pathEnv = process.env[p]
+        break
+      }
+    }
   }
 
+  pathEnv = pathEnv.split(colon)
+
+  if (isWindows) {
+    pathEnv.unshift(process.cwd())
+    pathExt = (opt.pathExt || process.env.PATHEXT || '.EXE').split(colon)
+    if (cmd.indexOf('.') !== -1 && pathExt[0] !== '')
+      pathExt.unshift('')
+  }
+
   // If it's absolute, then we don't bother searching the pathenv.
   // just check the file itself, and that's it.
   if (isAbsolute(cmd))
-    pathEnv = [""]
+    pathEnv = ['']
 
   ;(function F (i, l) {
-    if (i === l) return cb(new Error("not found: "+cmd))
+    if (i === l) return cb(new Error('not found: '+cmd))
     var p = path.resolve(pathEnv[i], cmd)
@@ -71,17 +97,29 @@ ;(function E (ii, ll) {
 
-  var pathEnv = (opt.path || process.env.PATH || "").split(colon)
-  var pathExt = [""]
+  var pathEnv = opt.path || process.env.PATH || ''
+  var pathExt = ['']
 
-  if (process.platform === "win32") {
-    pathEnv.push(process.cwd())
-    pathExt = (opt.pathExt || process.env.PATHEXT || ".EXE").split(colon)
-    if (cmd.indexOf(".") !== -1) {
-      pathExt.unshift("")
+  // On windows, env.Path is common.
+  if (isWindows && !pathEnv) {
+    var k = Object.keys(process.env)
+    for (var p = 0; p < k.length; p++) {
+      if (p.toLowerCase() === 'path') {
+        pathEnv = process.env[p]
+        break
+      }
     }
   }
 
+  pathEnv = pathEnv.split(colon)
+
+  if (isWindows) {
+    pathEnv.unshift(process.cwd())
+    pathExt = (opt.pathExt || process.env.PATHEXT || '.EXE').split(colon)
+    if (cmd.indexOf('.') !== -1 && pathExt[0] !== '')
+      pathExt.unshift('')
+  }
+
   // If it's absolute, then we don't bother searching the pathenv.
   // just check the file itself, and that's it.
   if (isAbsolute(cmd))
-    pathEnv = [""]
+    pathEnv = ['']
 
@@ -101,3 +139,3 @@ for (var i = 0, l = pathEnv.length; i < l; i ++) {
 
-  throw new Error("not found: "+cmd)
+  throw new Error('not found: '+cmd)
 }

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 3 instances in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

7748

increased by24.15%

Lines of code

185

increased by21.71%

Number of lines in readme file

35

increased by483.33%

Worsened metrics

Number of low supply chain risk alerts

14

increased by133.33%

No dependency changes