Update package.json

[jadoonf]

No description provided.

[jadoonf]

📊 Package size report   0.8%↑

File	Before	After
.github/workflows/lstn.yml	319 B	26%↑402 B
Total (Includes all files)	9.8 kB	0.8%↑9.9 kB
Tarball size	3.7 kB	0.7%↑3.8 kB

Unchanged files

File	Size
.github/workflows/explain.yml	736 B
.github/workflows/package-size-report.yml	536 B
.github/workflows/test/lstn-cli-workflow.yml	2.0 kB
.github/workflows/test/lstn-dynamic.yml	378 B
.github/workflows/test/lstn-policy.yml	334 B
index.js	28 B
package.json	904 B
README.md	3.4 kB
rules.yml	1.2 kB

_{🤖 This report was automatically generated by pkg-size-action}

[github-actions]

The following behavior was detected in the dependency tree during installation

🛑 3 critical activities detected

chokidar@3.5.3

🛑 This package has inconsistent dependencies in the tarball's package.json

Dependency type

Direct dependency

Metadata

description:	The dependencies in the tarball's package.json differ from the dependencies present in the NPM registry.
path:	package.json

ink@3.2.0

🛑 The name of this package closely resembles other package names ("ini") which are popular on NPM: it might be a typosquatting attempt

Dependency type

Direct dependency

Metadata

similars:

[ini]

findit@2.0.0

🛑 The name of this package closely resembles other package names ("findit2") which are popular on NPM: it might be a typosquatting attempt

Dependency type

Direct dependency

Metadata

similars:

[findit2]

⚠️ 2 medium activities detected

ink@3.2.0

⚠️ install script detected in package.json

Dependency type

Direct dependency

Metadata

description:	A package that has an install script in package.json is a potential security risk, as it can be used to execute arbitrary code on the system with the permissions of the user running npm install. This is a common attack vector for malicious packages.
path:	package.json

core-js@3.31.1

⚠️ install script detected in package.json

Dependency type

Direct dependency

Metadata

description:	A package that has an install script in package.json is a potential security risk, as it can be used to execute arbitrary code on the system with the permissions of the user running npm install. This is a common attack vector for malicious packages.
path:	package.json

🔷 2 low activities detected

source-map-support@0.5.21

🔷 This package version is 0.X.Y: the semver spec mandates those versions for initial development meaning that anything may change at any time and the public API of this package should not be considered stable.

Dependency type

Direct dependency

Metadata

detail:	NPM allows changes that do not modify the left-most non-zero element in the [major, minor, patch] tuple. In other words, this allows patch and minor updates for versions 1.0.0 and above, patch updates for versions 0.X >= 0.1.0, and no updates for versions 0.0.X. So, if you depend on ^0.5.21, npm update won't update it to 0.6.0, because only patch updates are allowed.
detail_link:	https://lstn.dev/semver-parser-node
reason:	0.5.21 is less than or equal to 0.x.x-0
spec:	https://lstn.dev/semver-spec-0yz

core-js@3.31.1

🔷 shady link detected in package

Dependency type

Direct dependency

Metadata

description:	A package that contains a link to a shady domain is a potential security risk, as it can be used to exfiltrate sensitive information from the system. A low severity is assigned to this rule as it is not always a security risk, but it is a good practice to avoid those links.
path:	modules/es.string.link.js

generated by listen.dev

[jadoonf]

listen.dev ∙ Security Report

🚨 Critical: 1 | ⚠️ Medium: 3 | 🔷 Low: 4

Critical Severity (1)

• urix@0.1.0 - Details

  • Context: This package is used in the lib/parser.js and util/process.js modules of your project.
  • Consequence: This package version is 0.X.Y, meaning the public API of this package should not be considered stable.
  • Action: Run npm update urix@latest to update to the latest version.

• ...

• request-promise-native@1.0.9 - Details

  • Consequence: This package has inconsistent scripts in the tarball's package.json.
  • Action: Run npm update request-promise-native@latest to update to the latest version.

Medium Severity (3)

• request@2.88.2 - Details
  • Consequence: This version of the request package has a known vulnerability that could allow an attacker to perform Server-Side Request Forgery (SSRF).
  • Action: Run npm update request@latest to update to the latest version.
• ...

Low Severity (4)

---

Did you find this alert helpful? Provide feedback here.

Powered by listen.dev