@depup/systeminformation 5.33.6-depup.0 → 5.33.10-depup.0

package/README.md

@@ -13,8 +13,8 @@ npm install @depup/systeminformation
 
 | Field | Value |
 |-------|-------|
-| Original | [systeminformation](https://www.npmjs.com/package/systeminformation) @ 5.33.6 |
-| Processed | 2026-08-30 |
+| Original | [systeminformation](https://www.npmjs.com/package/systeminformation) @ 5.33.10 |
+| Processed | 2026-09-13 |
 | Smoke test | passed |
 | Deps updated | 0 |
 

package/changes.json

@@ -1,5 +1,5 @@
 {
   "bumped": {},
-  "timestamp": "2026-08-30T00:59:35.001Z",
+  "timestamp": "2026-09-13T01:00:18.134Z",
   "totalUpdated": 0
 }

package/lib/audio.js

@@ -55,7 +55,7 @@ function parseAudioType(str, input, output) {
   if (str.indexOf('mikr') >= 0) {
     result = 'Microphone';
   }
-  if (str.indexOf('phone') >= 0) {
+  if (str.indexOf('phone') >= 0 && str.indexOf('headphone') < 0) {
     result = 'Phone';
   }
   if (str.indexOf('controll') >= 0) {
@@ -111,11 +111,16 @@ function parseLinuxAudioAlsa(stdout) {
   const lines = cards.split('\n');
   lines.forEach((line, i) => {
     // ' 1 [Device         ]: USB-Audio - USB Audio Device'
-    const card = line.match(/^\s*(\d+)\s+\[(.+?)\s*\]:\s*(\S+)\s+-\s+(.*)$/);
-    if (card) {
+    const card = line.match(/^\s*(\d+)\s+\[(.+?)\s*\]:\s*(.*)$/);
+    if (card && card[3].trim()) {
       const index = card[1];
-      const driver = card[3];
-      const name = card[4].trim();
+      // some drivers (e.g. bcm2835) print an unterminated driver string, gluing the name to it
+      const sep = card[3].lastIndexOf(' - ');
+      const name = (sep >= 0 ? card[3].substring(sep + 3) : card[3]).trim();
+      let driver = (sep >= 0 ? card[3].substring(0, sep) : '').trim();
+      if (name && driver.endsWith(name)) {
+        driver = driver.substring(0, driver.length - name.length).trim();
+      }
       // second line holds the long name, which is prefixed with the manufacturer on USB devices
       const longName = (lines[i + 1] || '').trim();
       const manufacturer = longName.indexOf(name) > 0 ? longName.substring(0, longName.indexOf(name)).trim() : '';

package/lib/filesystem.js

@@ -43,8 +43,20 @@ function fsSize(drive, callback) {
   }
 
   let macOsDisks = [];
+  const macOsFsTypes = new Map();
   let osMounts = [];
 
+  // macOS df has no type column, so the type used to be guessed from diskutil - which only ever
+  // produced APFS, HFS or NFS and therefore never recognised zfs, exfat, msdos or smbfs. mount
+  // knows the real type, so prefer it and keep the old names for the three it could produce.
+  function macOsFsType(fs) {
+    const type = macOsFsTypes.get(fs);
+    if (!type) {
+      return getmacOsFsType(fs);
+    }
+    return type === 'apfs' ? 'APFS' : type === 'hfs' ? 'HFS' : type === 'nfs' ? 'NFS' : type;
+  }
+
   function getmacOsFsType(fs) {
     if (!fs.startsWith('/')) {
       return 'NFS';
@@ -86,6 +98,59 @@ function fsSize(drive, callback) {
     return lines;
   }
 
+  // ZFS datasets share the pool, so df only reports what a dataset references itself - a parent
+  // holding its data in child datasets looks empty (#1017). Only `zfs list` knows the
+  // hierarchical usage, so query it once when a zfs mount is present.
+  function applyZfsUsage(data, cb) {
+    if (!data.some((item) => item.type === 'zfs')) {
+      return cb(data);
+    }
+    exec('zfs list -H -p -o name,used,avail,mountpoint', { ...util.execOptsLinux, timeout: 5000 }, (error, stdout) => {
+      if (error) {
+        // a truncated or timed out listing would correct only part of the datasets and leave the
+        // rest on their df values - correct none instead, so the result stays consistent
+        return cb(data);
+      }
+      const byMount = Object.create(null);
+      const byName = Object.create(null);
+      (stdout || '')
+        .toString()
+        .split('\n')
+        .forEach((line) => {
+          const parts = line.split('\t');
+          if (parts.length < 4) {
+            return;
+          }
+          const entry = { used: parseInt(parts[1], 10), available: parseInt(parts[2], 10) };
+          if (isNaN(entry.used) || isNaN(entry.available)) {
+            return;
+          }
+          byName[parts[0]] = entry;
+          const mount = parts[3].trim();
+          // several datasets can carry the same mountpoint (root-on-zfs boot environments all
+          // declare "/"), so the mount index is only a fallback - keep the first one
+          if (mount.startsWith('/') && !byMount[mount]) {
+            byMount[mount] = entry;
+          }
+        });
+      data.forEach((item) => {
+        if (item.type !== 'zfs') {
+          return;
+        }
+        // the fs column is the exact dataset name and therefore unambiguous, unlike the mountpoint
+        const dataset = byName[item.fs] || byMount[item.mount];
+        if (!dataset || !(dataset.used + dataset.available)) {
+          return;
+        }
+        item.used = dataset.used;
+        item.available = dataset.available;
+        item.size = dataset.used + dataset.available;
+        item.use = parseFloat(((100.0 * dataset.used) / item.size).toFixed(2));
+      });
+      cb(data);
+    });
+  }
+
   function parseDf(lines) {
     const data = [];
     // filesystem (first column) and mount point (last column) may contain spaces:
@@ -98,7 +163,7 @@ function fsSize(drive, callback) {
         const parts = line.trim().match(hasType ? dfWithType : dfNoType);
         if (parts && (parts[1].startsWith('/') || parts[hasType ? 6 : 5] === '/' || parts[1].indexOf('/') > 0 || parts[1].indexOf(':') === 1 || (!_darwin && !isLinuxTmpFs(parts[2])))) {
           const fs = parts[1];
-          const fsType = hasType ? parts[2] : getmacOsFsType(parts[1]);
+          const fsType = hasType ? parts[2] : macOsFsType(parts[1]);
           const size = parseInt(parts[hasType ? 3 : 2], 10) * 1024;
           const used = parseInt(parts[hasType ? 4 : 3], 10) * 1024;
           const available = parseInt(parts[hasType ? 5 : 4], 10) * 1024;
@@ -142,11 +207,16 @@ function fsSize(drive, callback) {
             execSync('mount')
               .toString()
               .split('\n')
-              .filter((line) => {
-                return line.startsWith('/');
-              })
               .forEach((line) => {
-                osMounts[line.split(' ')[0]] = line.toLowerCase().indexOf('read-only') === -1;
+                // mount output: "<fs> on <mountpoint> (<type>, <options>)"
+                const fs = line.split(' ')[0];
+                const type = line.match(/\(([^),]+)[^)]*\)$/);
+                if (fs && type) {
+                  macOsFsTypes.set(fs, type[1].trim().toLowerCase());
+                }
+                if (line.startsWith('/')) {
+                  osMounts[fs] = line.toLowerCase().indexOf('read-only') === -1;
+                }
               });
           } catch {
             util.noop();
@@ -195,19 +265,23 @@ function fsSize(drive, callback) {
             });
           }
           if ((!error || data.length) && stdout.toString().trim() !== '') {
-            if (callback) {
-              callback(data);
-            }
-            resolve(data);
+            applyZfsUsage(data, (data) => {
+              if (callback) {
+                callback(data);
+              }
+              resolve(data);
+            });
           } else {
             exec('df -kPT 2>/dev/null', { maxBuffer: 1024 * 1024 }, (error, stdout) => {
               // fixed issue alpine fallback
               const lines = filterLines(stdout);
               data = parseDf(lines);
-              if (callback) {
-                callback(data);
-              }
-              resolve(data);
+              applyZfsUsage(data, (data) => {
+                if (callback) {
+                  callback(data);
+                }
+                resolve(data);
+              });
             });
           }
         });
@@ -1722,6 +1796,10 @@ function diskLayout(callback) {
               const smartDev = JSON.parse(execSync('smartctl --scan -j').toString());
               if (smartDev && smartDev.devices && smartDev.devices.length > 0) {
                 smartDev.devices.forEach((dev) => {
+                  // device names come from smartctl output - never let anything but a plain path reach the shell
+                  if (!/^[\w/.,:\\-]+$/.test(String(dev.name || ''))) {
+                    return;
+                  }
                   workload.push(execPromiseSave(`smartctl -j -a ${dev.name}`, util.execOptsWin));
                 });
               }

package/lib/graphics.js

@@ -17,6 +17,7 @@ const fs = require('fs');
 const path = require('path');
 const exec = require('child_process').exec;
 const execSync = require('child_process').execSync;
+const execFileSync = require('child_process').execFileSync;
 const util = require('./util');
 
 const _platform = process.platform;
@@ -481,14 +482,9 @@ function graphics(callback) {
     if (nvidiaSmiExe) {
       const nvidiaSmiOpts =
         '--query-gpu=driver_version,pci.sub_device_id,name,pci.bus_id,fan.speed,memory.total,memory.used,memory.free,utilization.gpu,utilization.memory,temperature.gpu,temperature.memory,power.draw,power.limit,clocks.gr,clocks.mem --format=csv,noheader,nounits';
-      const cmd = `"${nvidiaSmiExe}" ${nvidiaSmiOpts}`;
-      if (_linux) {
-        options.stdio = ['pipe', 'pipe', 'ignore'];
-      }
+      options.stdio = ['pipe', 'pipe', 'ignore'];
       try {
-        const sanitized = cmd + (_linux ? '  2>/dev/null' : '') + (_windows ? '  2> nul' : '');
-        const res = execSync(sanitized, options).toString();
-        return res;
+        return execFileSync(nvidiaSmiExe, nvidiaSmiOpts.split(' '), options).toString();
       } catch {
         util.noop();
       }

package/lib/internet.js

@@ -166,6 +166,12 @@ function inetLatency(host, callback) {
         }
         return resolve(null);
       }
+      if (hostSanitized.startsWith('-')) {
+        if (callback) {
+          callback(null);
+        }
+        return resolve(null);
+      }
       let params;
       if (_linux || _freebsd || _openbsd || _netbsd || _darwin) {
         if (_linux) {

package/lib/network.js

@@ -368,8 +368,8 @@ function getWindowsWiredProfilesInformation() {
 
 function getWindowsWirelessIfaceSSID(interfaceName) {
   try {
-    const result = execSync(`netsh wlan show  interface name="${interfaceName}" | findstr "SSID"`, util.execOptsWin);
-    const SSID = result.split('\r\n').shift();
+    const result = execFileSync('netsh', ['wlan', 'show', 'interface', `name=${util.sanitizeString(interfaceName)}`], util.execOptsWin).toString();
+    const SSID = result.split('\r\n').find((l) => l.includes('SSID')) || '';
     const parseSSID = SSID.split(':').pop().trim();
     return parseSSID;
   } catch {
@@ -420,7 +420,7 @@ function getWindowsIEEE8021x(connectionType, iface, ifaces) {
       const SSID = getWindowsWirelessIfaceSSID(iface);
       if (SSID !== 'Unknown') {
         const ifaceSanitized = util.sanitizeString(SSID);
-        const profiles = execSync(`netsh wlan show profiles "${ifaceSanitized}"`, util.execOptsWin).split('\r\n');
+        const profiles = execFileSync('netsh', ['wlan', 'show', 'profiles', ifaceSanitized], util.execOptsWin).toString().split('\r\n');
         i8021xState = (profiles.find((l) => l.indexOf('802.1X') >= 0) || '').trim();
         i8021xProtocol = (profiles.find((l) => l.indexOf('EAP') >= 0) || '').trim();
       }
@@ -943,7 +943,7 @@ function networkInterfaces(callback, rescan, defaultString) {
                 ip6subnet = ip6linksubnet;
               }
               const iface = dev.split(':')[0].trim();
-              const ifaceSanitized = util.sanitizeString(iface);
+              const ifaceSanitized = util.sanitizeString(iface, true);
               const cmd = `echo -n "addr_assign_type: "; cat /sys/class/net/${ifaceSanitized}/addr_assign_type 2>/dev/null; echo;
             echo -n "address: "; cat /sys/class/net/${ifaceSanitized}/address 2>/dev/null; echo;
             echo -n "addr_len: "; cat /sys/class/net/${ifaceSanitized}/addr_len 2>/dev/null; echo;

package/lib/osinfo.js

@@ -18,7 +18,6 @@ const fs = require('fs');
 const util = require('./util');
 const exec = require('child_process').exec;
 const execSync = require('child_process').execSync;
-const execFile = require('child_process').execFile;
 
 const _platform = process.platform;
 
@@ -775,78 +774,47 @@ function versions(apps, callback) {
           });
         }
         if ({}.hasOwnProperty.call(appsObj.versions, 'postgresql')) {
-          if (_linux) {
-            exec('locate bin/postgres', (error, stdout) => {
-              if (!error) {
-                const safePath = /^[a-zA-Z0-9/_.-]+$/;
-                const postgresqlBin = stdout
-                  .toString()
-                  .split('\n')
-                  .filter((p) => safePath.test(p.trim()))
-                  .sort();
-                if (postgresqlBin.length) {
-                  execFile(postgresqlBin[postgresqlBin.length - 1], ['-V'], (error, stdout) => {
-                    if (!error) {
-                      const postgresql = stdout.toString().split('\n')[0].split(' ') || [];
-                      appsObj.versions.postgresql = postgresql.length ? postgresql[postgresql.length - 1] : '';
+          if (_windows) {
+            util.powerShell('Get-CimInstance Win32_Service | select caption | fl').then((stdout) => {
+              let serviceSections = stdout.split(/\n\s*\n/);
+              serviceSections.forEach((item) => {
+                if (item.trim() !== '') {
+                  let lines = item.trim().split('\r\n');
+                  let srvCaption = util.getValue(lines, 'caption', ':', true).toLowerCase();
+                  if (srvCaption.indexOf('postgresql') > -1) {
+                    const parts = srvCaption.split(' server ');
+                    if (parts.length > 1) {
+                      appsObj.versions.postgresql = parts[1];
                     }
-                    functionProcessed();
-                  });
-                } else {
-                  functionProcessed();
-                }
-              } else {
-                exec('psql -V', (error, stdout) => {
-                  if (!error) {
-                    const postgresql = stdout.toString().split('\n')[0].split(' ') || [];
-                    appsObj.versions.postgresql = postgresql.length ? postgresql[postgresql.length - 1] : '';
-                    appsObj.versions.postgresql = appsObj.versions.postgresql.split('-')[0];
                   }
-                  functionProcessed();
-                });
-              }
+                }
+              });
+              functionProcessed();
             });
           } else {
-            if (_windows) {
-              util.powerShell('Get-CimInstance Win32_Service | select caption | fl').then((stdout) => {
-                let serviceSections = stdout.split(/\n\s*\n/);
-                serviceSections.forEach((item) => {
-                  if (item.trim() !== '') {
-                    let lines = item.trim().split('\r\n');
-                    let srvCaption = util.getValue(lines, 'caption', ':', true).toLowerCase();
-                    if (srvCaption.indexOf('postgresql') > -1) {
-                      const parts = srvCaption.split(' server ');
-                      if (parts.length > 1) {
-                        appsObj.versions.postgresql = parts[1];
-                      }
-                    }
-                  }
-                });
-                functionProcessed();
-              });
-            } else {
-              exec('postgres -V', (error, stdout) => {
-                if (!error) {
-                  const postgresql = stdout.toString().split('\n')[0].split(' ') || [];
-                  appsObj.versions.postgresql = postgresql.length ? postgresql[postgresql.length - 1] : '';
-                  if (appsObj.versions.postgresql.includes('(') && postgresql.length >= 2 && !postgresql[postgresql.length - 2].includes('(')) {
-                    appsObj.versions.postgresql = postgresql[postgresql.length - 2];
-                  }
+            const parsePostgres = (stdout) => {
+              const postgresql = stdout.toString().split('\n')[0].split(' ') || [];
+              let version = postgresql.length ? postgresql[postgresql.length - 1] : '';
+              if (version.includes('(') && postgresql.length >= 2 && !postgresql[postgresql.length - 2].includes('(')) {
+                version = postgresql[postgresql.length - 2];
+              }
+              return version.split('-')[0];
+            };
+            // no `locate`: its output is any user-writable path and must not be executed
+            const tryPostgres = (cmds) => {
+              if (!cmds.length) {
+                return functionProcessed();
+              }
+              exec(cmds[0], (error, stdout) => {
+                if (!error && stdout.toString().trim()) {
+                  appsObj.versions.postgresql = parsePostgres(stdout);
                   functionProcessed();
                 } else {
-                  exec('pg_config --version', (error, stdout) => {
-                    if (!error) {
-                      const postgresql = stdout.toString().split('\n')[0].split(' ') || [];
-                      appsObj.versions.postgresql = postgresql.length ? postgresql[postgresql.length - 1] : '';
-                      if (appsObj.versions.postgresql.includes('(') && postgresql.length >= 2 && !postgresql[postgresql.length - 2].includes('(')) {
-                        appsObj.versions.postgresql = postgresql[postgresql.length - 2];
-                      }
-                    }
-                    functionProcessed();
-                  });
+                  tryPostgres(cmds.slice(1));
                 }
               });
-            }
+            };
+            tryPostgres(['postgres -V', 'pg_config --version', 'psql -V']);
           }
         }
         if ({}.hasOwnProperty.call(appsObj.versions, 'perl')) {

package/lib/processes.js

@@ -261,12 +261,20 @@ function services(srv, callback) {
                 });
                 if (_linux) {
                   // calc process_cpu - ps is not accurate in linux!
+                  // ps pcpu is a lifetime average, the /proc values below are an interval share -
+                  // drop the ps seed instead of adding both (#1007)
+                  result.forEach((item) => {
+                    item.cpu = 0;
+                  });
                   let cmd = 'cat /proc/stat | grep "cpu "';
                   for (let i in result) {
                     for (let j in result[i].pids) {
                       cmd += ';cat /proc/' + result[i].pids[j] + '/stat';
                     }
                   }
+                  // freeze the baseline before the async call - a concurrent call overwrites _services_cpu
+                  // and would leave this one dividing by a few jiffies (#1007)
+                  const cpuBaseline = Object.assign({}, _services_cpu);
                   exec(cmd, { maxBuffer: 1024 * 102400 }, function (error, stdout) {
                     let curr_processes = stdout.toString().split('\n');
 
@@ -277,7 +285,7 @@ function services(srv, callback) {
                     let list_new = {};
                     let resultProcess = {};
                     curr_processes.forEach((element) => {
-                      resultProcess = calcProcStatLinux(element, all, _services_cpu);
+                      resultProcess = calcProcStatLinux(element, all, cpuBaseline);
 
                       if (resultProcess.pid) {
                         let listPos = -1;
@@ -297,9 +305,7 @@ function services(srv, callback) {
                           cpuu: resultProcess.cpuu,
                           cpus: resultProcess.cpus,
                           utime: resultProcess.utime,
-                          stime: resultProcess.stime,
-                          cutime: resultProcess.cutime,
-                          cstime: resultProcess.cstime
+                          stime: resultProcess.stime
                         };
                       }
                     });
@@ -474,6 +480,19 @@ function parseProcStat(line) {
   return user + nice + system + idle + iowait + irq + softirq + steal + guest + guest_nice;
 }
 
+// drops NaN/Infinity/negative values and scales cpuu + cpus down proportionally
+// if their sum exceeds 100 (normalized against all cores)
+function clampCpuPair(cpuu, cpus) {
+  if (!isFinite(cpuu) || cpuu < 0) { cpuu = 0; }
+  if (!isFinite(cpus) || cpus < 0) { cpus = 0; }
+  const total = cpuu + cpus;
+  if (total > 100) {
+    cpuu = (cpuu / total) * 100;
+    cpus = (cpus / total) * 100;
+  }
+  return { cpuu: cpuu, cpus: cpus };
+}
+
 function calcProcStatLinux(line, all, _cpu_old) {
   let statparts = line.replace(/ +/g, ' ').split(')');
   if (statparts.length >= 2) {
@@ -482,35 +501,34 @@ function calcProcStatLinux(line, all, _cpu_old) {
       let pid = parseInt(statparts[0].split(' ')[0]);
       let utime = parseInt(parts[12]);
       let stime = parseInt(parts[13]);
-      let cutime = parseInt(parts[14]);
-      let cstime = parseInt(parts[15]);
 
-      // calc
+      // calc - child times (cutime/cstime) are deliberately left out: reaping a child adds its
+      // whole lifetime in one interval, which is what produced the >100% spikes in #1007.
+      // top, htop and Task Manager exclude them too.
       let cpuu = 0;
       let cpus = 0;
       if (_cpu_old.all > 0 && _cpu_old.list[pid]) {
-        cpuu = ((utime + cutime - _cpu_old.list[pid].utime - _cpu_old.list[pid].cutime) / (all - _cpu_old.all)) * 100; // user
-        cpus = ((stime + cstime - _cpu_old.list[pid].stime - _cpu_old.list[pid].cstime) / (all - _cpu_old.all)) * 100; // system
+        const delta = all - _cpu_old.all;
+        cpuu = delta > 0 ? ((utime - _cpu_old.list[pid].utime) / delta) * 100 : 0; // user
+        cpus = delta > 0 ? ((stime - _cpu_old.list[pid].stime) / delta) * 100 : 0; // system
       } else {
-        cpuu = ((utime + cutime) / all) * 100; // user
-        cpus = ((stime + cstime) / all) * 100; // system
+        cpuu = all > 0 ? (utime / all) * 100 : 0; // user
+        cpus = all > 0 ? (stime / all) * 100 : 0; // system
       }
+      // normalized against all cores, so 100 is the ceiling for cpuu + cpus
+      const clamped = clampCpuPair(cpuu, cpus);
       return {
         pid: pid,
         utime: utime,
         stime: stime,
-        cutime: cutime,
-        cstime: cstime,
-        cpuu: cpuu,
-        cpus: cpus
+        cpuu: clamped.cpuu,
+        cpus: clamped.cpus
       };
     } else {
       return {
         pid: 0,
         utime: 0,
         stime: 0,
-        cutime: 0,
-        cstime: 0,
         cpuu: 0,
         cpus: 0
       };
@@ -520,8 +538,6 @@ function calcProcStatLinux(line, all, _cpu_old) {
       pid: 0,
       utime: 0,
       stime: 0,
-      cutime: 0,
-      cstime: 0,
       cpuu: 0,
       cpus: 0
     };
@@ -533,18 +549,21 @@ function calcProcStatWin(procStat, all, _cpu_old) {
   let cpuu = 0;
   let cpus = 0;
   if (_cpu_old.all > 0 && _cpu_old.list[procStat.pid]) {
-    cpuu = ((procStat.utime - _cpu_old.list[procStat.pid].utime) / (all - _cpu_old.all)) * 100; // user
-    cpus = ((procStat.stime - _cpu_old.list[procStat.pid].stime) / (all - _cpu_old.all)) * 100; // system
+    const delta = all - _cpu_old.all;
+    cpuu = delta > 0 ? ((procStat.utime - _cpu_old.list[procStat.pid].utime) / delta) * 100 : 0; // user
+    cpus = delta > 0 ? ((procStat.stime - _cpu_old.list[procStat.pid].stime) / delta) * 100 : 0; // system
   } else {
-    cpuu = (procStat.utime / all) * 100; // user
-    cpus = (procStat.stime / all) * 100; // system
+    cpuu = all > 0 ? (procStat.utime / all) * 100 : 0; // user
+    cpus = all > 0 ? (procStat.stime / all) * 100 : 0; // system
   }
+  // same ceiling as the linux path - cpuu + cpus stays inside [0, 100] (#1007)
+  const clamped = clampCpuPair(cpuu, cpus);
   return {
     pid: procStat.pid,
     utime: procStat.utime,
     stime: procStat.stime,
-    cpuu: cpuu > 0 ? cpuu : 0,
-    cpus: cpus > 0 ? cpus : 0
+    cpuu: clamped.cpuu,
+    cpus: clamped.cpus
   };
 }
 
@@ -637,6 +656,11 @@ function processes(callback) {
     let command = '';
     let params = '';
     let fullcommand = line.substring(parsedhead[12].from + offset, parsedhead[12].to + offset2).trim();
+    // zombies are printed as "[name] <defunct>" - drop the marker so the bracket handling below
+    // sees a plain "[name]" and does not leak "] <defunct>" into command and name
+    if (fullcommand.endsWith(' <defunct>')) {
+      fullcommand = fullcommand.slice(0, -10).trim();
+    }
     if (fullcommand.substr(fullcommand.length - 1) === ']') {
       fullcommand = fullcommand.slice(0, -1);
     }
@@ -855,6 +879,9 @@ function processes(callback) {
                   result.list.forEach((element) => {
                     cmd += ';cat /proc/' + element.pid + '/stat';
                   });
+                  // freeze the baseline before the async call - a concurrent call overwrites _processes_cpu
+                  // and would leave this one dividing by a few jiffies (#1007)
+                  const cpuBaseline = Object.assign({}, _processes_cpu);
                   exec(cmd, { maxBuffer: 1024 * 102400 }, (error, stdout) => {
                     let curr_processes = stdout.toString().split('\n');
 
@@ -865,7 +892,7 @@ function processes(callback) {
                     let list_new = {};
                     let resultProcess = {};
                     curr_processes.forEach((element) => {
-                      resultProcess = calcProcStatLinux(element, all, _processes_cpu);
+                      resultProcess = calcProcStatLinux(element, all, cpuBaseline);
 
                       if (resultProcess.pid) {
                         // store pcpu in outer array
@@ -885,9 +912,7 @@ function processes(callback) {
                           cpuu: resultProcess.cpuu,
                           cpus: resultProcess.cpus,
                           utime: resultProcess.utime,
-                          stime: resultProcess.stime,
-                          cutime: resultProcess.cutime,
-                          cstime: resultProcess.cstime
+                          stime: resultProcess.stime
                         };
                       }
                     });
@@ -950,6 +975,9 @@ function processes(callback) {
           }
         } else if (_windows) {
           try {
+            // freeze the baseline before the async call - a concurrent call overwrites _processes_cpu
+            // and would leave this one with a non positive delta (#1007)
+            const cpuBaseline = Object.assign({}, _processes_cpu);
             util
               .powerShell(
                 `Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage,
@@ -960,8 +988,10 @@ function processes(callback) {
                   const procs = [];
                   const procStats = [];
                   const list_new = {};
-                  let allcpuu = 0;
-                  let allcpus = 0;
+                  // accumulate from the previous totals and add deltas only - a process that exited
+                  // must not lower the total, otherwise the denominator turns negative (#559)
+                  let allcpuu = cpuBaseline.all_utime;
+                  let allcpus = cpuBaseline.all_stime;
                   let processArray = [];
                   try {
                     stdout = stdout.trim().replace(/^\uFEFF/, '');
@@ -981,8 +1011,9 @@ function processes(callback) {
                     const utime = element.UserModeTime;
                     const stime = element.KernelModeTime;
                     const memw = element.WorkingSetSize;
-                    allcpuu = allcpuu + utime;
-                    allcpus = allcpus + stime;
+                    const cpuOld = cpuBaseline.list[pid];
+                    allcpuu += utime - (cpuOld ? cpuOld.utime : 0);
+                    allcpus += stime - (cpuOld ? cpuOld.stime : 0);
                     result.all++;
                     if (!statusValue) {
                       result.unknown++;
@@ -1027,7 +1058,7 @@ function processes(callback) {
                   result.sleeping = result.all - result.running - result.blocked - result.unknown;
                   result.list = procs;
                   procStats.forEach((element) => {
-                    let resultProcess = calcProcStatWin(element, allcpuu + allcpus, _processes_cpu);
+                    let resultProcess = calcProcStatWin(element, allcpuu + allcpus, cpuBaseline);
 
                     // store pcpu in outer array
                     let listPos = result.list.map((e) => e.pid).indexOf(resultProcess.pid);
@@ -1150,12 +1181,16 @@ function processLoad(proc, callback) {
       if (procSanitized && processes.length && processes[0] !== '------') {
         if (_windows) {
           try {
+            // freeze the baseline before the async call - a concurrent call overwrites _process_cpu
+            // and would leave this one with a non positive delta (#1007)
+            const cpuBaseline = Object.assign({}, _process_cpu);
             util.powerShell('Get-CimInstance Win32_Process | select ProcessId,Caption,UserModeTime,KernelModeTime,WorkingSetSize | ConvertTo-Json -compress').then((stdout, error) => {
               if (!error) {
                 const procStats = [];
                 const list_new = {};
-                let allcpuu = 0;
-                let allcpus = 0;
+                // see processes() - never lower the total when a process exits (#559)
+                let allcpuu = cpuBaseline.all_utime;
+                let allcpus = cpuBaseline.all_stime;
                 let processArray = [];
                 try {
                   stdout = stdout.trim().replace(/^\uFEFF/, '');
@@ -1172,8 +1207,9 @@ function processLoad(proc, callback) {
                   const utime = element.UserModeTime;
                   const stime = element.KernelModeTime;
                   const mem = element.WorkingSetSize;
-                  allcpuu = allcpuu + utime;
-                  allcpus = allcpus + stime;
+                  const cpuOld = cpuBaseline.list[pid];
+                  allcpuu += utime - (cpuOld ? cpuOld.utime : 0);
+                  allcpus += stime - (cpuOld ? cpuOld.stime : 0);
 
                   procStats.push({
                     pid: pid,
@@ -1231,7 +1267,7 @@ function processLoad(proc, callback) {
 
                 // calculate proc stats for each proc
                 procStats.forEach((element) => {
-                  let resultProcess = calcProcStatWin(element, allcpuu + allcpus, _process_cpu);
+                  let resultProcess = calcProcStatWin(element, allcpuu + allcpus, cpuBaseline);
 
                   let listPos = -1;
                   for (let j = 0; j < result.length; j++) {
@@ -1377,6 +1413,9 @@ function processLoad(proc, callback) {
                     cmd += ';cat /proc/' + result[i].pids[j] + '/stat';
                   }
                 }
+                // freeze the baseline before the async call - a concurrent call overwrites _process_cpu
+                // and would leave this one dividing by a few jiffies (#1007)
+                const cpuBaseline = Object.assign({}, _process_cpu);
                 exec(cmd, { maxBuffer: 1024 * 102400 }, (error, stdout) => {
                   let curr_processes = stdout.toString().split('\n');
 
@@ -1387,7 +1426,7 @@ function processLoad(proc, callback) {
                   let list_new = {};
                   let resultProcess = {};
                   curr_processes.forEach((element) => {
-                    resultProcess = calcProcStatLinux(element, all, _process_cpu);
+                    resultProcess = calcProcStatLinux(element, all, cpuBaseline);
 
                     if (resultProcess.pid) {
                       // find result item
@@ -1407,9 +1446,7 @@ function processLoad(proc, callback) {
                         cpuu: resultProcess.cpuu,
                         cpus: resultProcess.cpus,
                         utime: resultProcess.utime,
-                        stime: resultProcess.stime,
-                        cutime: resultProcess.cutime,
-                        cstime: resultProcess.cstime
+                        stime: resultProcess.stime
                       };
                     }
                   });

package/lib/wifi.js

@@ -193,7 +193,7 @@ function ifaceListLinux() {
 }
 
 function nmiDeviceLinux(iface) {
-  const cmd = `nmcli -t -f general,wifi-properties,capabilities,ip4,ip6 device show ${iface} 2> /dev/null`;
+  const cmd = `nmcli -t -f general,wifi-properties,capabilities,ip4,ip6 device show ${util.sanitizeString(iface, true)} 2> /dev/null`;
   try {
     const lines = execSync(cmd, util.execOptsLinux).toString().split('\n');
     const ssid = util.getValue(lines, 'GENERAL.CONNECTION');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@depup/systeminformation",
-  "version": "5.33.6-depup.0",
+  "version": "5.33.10-depup.0",
   "description": "Advanced, lightweight system and OS information library (with updated dependencies)",
   "license": "MIT",
   "author": "Sebastian Hildebrandt <hildebrandt@plus-innovations.com> (https://plus-innovations.com)",
@@ -111,8 +111,8 @@
     "changes": {},
     "depsUpdated": 0,
     "originalPackage": "systeminformation",
-    "originalVersion": "5.33.6",
-    "processedAt": "2026-08-30T00:59:35.725Z",
+    "originalVersion": "5.33.10",
+    "processedAt": "2026-09-13T01:00:18.796Z",
     "smokeTest": "passed"
   }
 }