@depup/systeminformation 5.33.8-depup.0 → 5.33.12-depup.0

package/README.md

@@ -13,8 +13,8 @@ npm install @depup/systeminformation
 
 | Field | Value |
 |-------|-------|
-| Original | [systeminformation](https://www.npmjs.com/package/systeminformation) @ 5.33.8 |
-| Processed | 2026-09-06 |
+| Original | [systeminformation](https://www.npmjs.com/package/systeminformation) @ 5.33.12 |
+| Processed | 2026-09-20 |
 | Smoke test | passed |
 | Deps updated | 0 |
 

package/changes.json

@@ -1,5 +1,5 @@
 {
   "bumped": {},
-  "timestamp": "2026-09-06T01:00:18.743Z",
+  "timestamp": "2026-09-20T01:02:36.649Z",
   "totalUpdated": 0
 }

package/lib/battery.js

@@ -29,7 +29,7 @@ const _sunos = _platform === 'sunos';
 
 function parseWinBatteryPart(lines, designedCapacity, fullChargeCapacity) {
   const result = {};
-  let status = parseInt(util.getValue(lines, 'BatteryStatus', ':').trim(), 10) || 0;
+  const status = parseInt(util.getValue(lines, 'BatteryStatus', ':').trim(), 10) || 0;
   // let status = util.getValue(lines, 'BatteryStatus', ':').trim();
   // 1 = "Discharging"
   // 2 = "On A/C"
@@ -111,7 +111,7 @@ module.exports = (callback) =>
         if (battery_path) {
           fs.readFile(battery_path + 'uevent', (error, stdout) => {
             if (!error) {
-              let lines = stdout.toString().split('\n');
+              const lines = stdout.toString().split('\n');
 
               result.isCharging = util.getValue(lines, 'POWER_SUPPLY_STATUS', '=').toLowerCase() === 'charging';
               result.acConnected = acConnected || result.isCharging;
@@ -176,7 +176,7 @@ module.exports = (callback) =>
       }
       if (_freebsd || _openbsd || _netbsd) {
         exec('sysctl -i hw.acpi.battery hw.acpi.acline', (error, stdout) => {
-          let lines = stdout.toString().split('\n');
+          const lines = stdout.toString().split('\n');
           const batteries = parseInt('0' + util.getValue(lines, 'hw.acpi.battery.units'), 10);
           const percent = parseInt('0' + util.getValue(lines, 'hw.acpi.battery.life'), 10);
           result.hasBattery = batteries > 0;
@@ -196,24 +196,45 @@ module.exports = (callback) =>
 
       if (_darwin) {
         exec(
-          'ioreg -n AppleSmartBattery -r | egrep "CycleCount|IsCharging|DesignCapacity|MaxCapacity|CurrentCapacity|DeviceName|BatterySerialNumber|Serial|TimeRemaining|Voltage"; pmset -g batt | grep %',
+          'ioreg -n AppleSmartBattery -r | egrep "CycleCount|IsCharging|DesignCapacity|MaxCapacity|CurrentCapacity|DeviceName|BatterySerialNumber|Serial|TimeRemaining|Voltage|BatteryData|NominalChargeCapacity"; pmset -g batt | grep %',
           (error, stdout) => {
             if (stdout) {
-              let lines = stdout.toString().replace(/ +/g, '').replace(/"+/g, '').replace(/-/g, '').split('\n');
+              const lines = stdout
+                .toString()
+                .replace(/^[ |]+/gm, '')
+                .replace(/ +/g, '')
+                .replace(/"+/g, '')
+                .replace(/-/g, '')
+                .split('\n');
+              const voltage = parseInt('0' + util.getValue(lines, 'voltage', '='), 10) / 1000.0;
+              const batteryData = util.getValue(lines, 'BatteryData', '=').replace(/^\{/, '').replace(/\}$/, '').split(',');
+              const maxCapacity = Math.round(
+                parseInt(
+                  '0' +
+                    (util.getValue(lines, 'AppleRawMaxCapacity', '=') ||
+                      util.getValue(lines, 'NominalChargeCapacity', '=') ||
+                      util.getValue(batteryData, 'FullChargeCapacity', '=') ||
+                      util.getValue(batteryData, 'NominalChargeCapacity', '=')),
+                  10
+                ) * (voltage || 1)
+              );
+              const currentCapacity = Math.round(parseInt('0' + (util.getValue(lines, 'AppleRawCurrentCapacity', '=') || util.getValue(batteryData, 'RemainingCapacity', '=')), 10) * (voltage || 1));
+              const designedCapacity = Math.round(parseInt('0' + (util.getValue(lines, 'DesignCapacity', '=') || util.getValue(batteryData, 'DesignCapacity', '=')), 10) * (voltage || 1));
+
               result.cycleCount = parseInt('0' + util.getValue(lines, 'cyclecount', '='), 10);
-              result.voltage = parseInt('0' + util.getValue(lines, 'voltage', '='), 10) / 1000.0;
+              result.voltage = voltage;
               result.capacityUnit = result.voltage ? 'mWh' : 'mAh';
-              result.maxCapacity = Math.round(parseInt('0' + util.getValue(lines, 'applerawmaxcapacity', '='), 10) * (result.voltage || 1));
-              result.currentCapacity = Math.round(parseInt('0' + util.getValue(lines, 'applerawcurrentcapacity', '='), 10) * (result.voltage || 1));
-              result.designedCapacity = Math.round(parseInt('0' + util.getValue(lines, 'DesignCapacity', '='), 10) * (result.voltage || 1));
+              result.maxCapacity = maxCapacity;
+              result.currentCapacity = currentCapacity;
+              result.designedCapacity = designedCapacity;
               result.manufacturer = 'Apple';
               result.serial = util.getValue(lines, 'BatterySerialNumber', '=') || util.getValue(lines, 'Serial', '=');
               result.model = util.getValue(lines, 'DeviceName', '=');
               let percent = null;
               const line = util.getValue(lines, 'internal', 'Battery');
-              let parts = line.split(';');
+              const parts = line.split(';');
               if (parts && parts[0]) {
-                let parts2 = parts[0].split('\t');
+                const parts2 = parts[0].split('\t');
                 if (parts2 && parts2[1]) {
                   percent = parseFloat(parts2[1].trim().replace(/%/g, ''));
                 }

package/lib/filesystem.js

@@ -43,8 +43,20 @@ function fsSize(drive, callback) {
   }
 
   let macOsDisks = [];
+  const macOsFsTypes = new Map();
   let osMounts = [];
 
+  // macOS df has no type column, so the type used to be guessed from diskutil - which only ever
+  // produced APFS, HFS or NFS and therefore never recognised zfs, exfat, msdos or smbfs. mount
+  // knows the real type, so prefer it and keep the old names for the three it could produce.
+  function macOsFsType(fs) {
+    const type = macOsFsTypes.get(fs);
+    if (!type) {
+      return getmacOsFsType(fs);
+    }
+    return type === 'apfs' ? 'APFS' : type === 'hfs' ? 'HFS' : type === 'nfs' ? 'NFS' : type;
+  }
+
   function getmacOsFsType(fs) {
     if (!fs.startsWith('/')) {
       return 'NFS';
@@ -86,6 +98,59 @@ function fsSize(drive, callback) {
     return lines;
   }
 
+  // ZFS datasets share the pool, so df only reports what a dataset references itself - a parent
+  // holding its data in child datasets looks empty (#1017). Only `zfs list` knows the
+  // hierarchical usage, so query it once when a zfs mount is present.
+  function applyZfsUsage(data, cb) {
+    if (!data.some((item) => item.type === 'zfs')) {
+      return cb(data);
+    }
+    exec('zfs list -H -p -o name,used,avail,mountpoint', { ...util.execOptsLinux, timeout: 5000 }, (error, stdout) => {
+      if (error) {
+        // a truncated or timed out listing would correct only part of the datasets and leave the
+        // rest on their df values - correct none instead, so the result stays consistent
+        return cb(data);
+      }
+      const byMount = Object.create(null);
+      const byName = Object.create(null);
+      (stdout || '')
+        .toString()
+        .split('\n')
+        .forEach((line) => {
+          const parts = line.split('\t');
+          if (parts.length < 4) {
+            return;
+          }
+          const entry = { used: parseInt(parts[1], 10), available: parseInt(parts[2], 10) };
+          if (isNaN(entry.used) || isNaN(entry.available)) {
+            return;
+          }
+          byName[parts[0]] = entry;
+          const mount = parts[3].trim();
+          // several datasets can carry the same mountpoint (root-on-zfs boot environments all
+          // declare "/"), so the mount index is only a fallback - keep the first one
+          if (mount.startsWith('/') && !byMount[mount]) {
+            byMount[mount] = entry;
+          }
+        });
+      data.forEach((item) => {
+        if (item.type !== 'zfs') {
+          return;
+        }
+        // the fs column is the exact dataset name and therefore unambiguous, unlike the mountpoint
+        const dataset = byName[item.fs] || byMount[item.mount];
+        if (!dataset || !(dataset.used + dataset.available)) {
+          return;
+        }
+        item.used = dataset.used;
+        item.available = dataset.available;
+        item.size = dataset.used + dataset.available;
+        item.use = parseFloat(((100.0 * dataset.used) / item.size).toFixed(2));
+      });
+      cb(data);
+    });
+  }
+
   function parseDf(lines) {
     const data = [];
     // filesystem (first column) and mount point (last column) may contain spaces:
@@ -98,7 +163,7 @@ function fsSize(drive, callback) {
         const parts = line.trim().match(hasType ? dfWithType : dfNoType);
         if (parts && (parts[1].startsWith('/') || parts[hasType ? 6 : 5] === '/' || parts[1].indexOf('/') > 0 || parts[1].indexOf(':') === 1 || (!_darwin && !isLinuxTmpFs(parts[2])))) {
           const fs = parts[1];
-          const fsType = hasType ? parts[2] : getmacOsFsType(parts[1]);
+          const fsType = hasType ? parts[2] : macOsFsType(parts[1]);
           const size = parseInt(parts[hasType ? 3 : 2], 10) * 1024;
           const used = parseInt(parts[hasType ? 4 : 3], 10) * 1024;
           const available = parseInt(parts[hasType ? 5 : 4], 10) * 1024;
@@ -142,11 +207,16 @@ function fsSize(drive, callback) {
             execSync('mount')
               .toString()
               .split('\n')
-              .filter((line) => {
-                return line.startsWith('/');
-              })
               .forEach((line) => {
-                osMounts[line.split(' ')[0]] = line.toLowerCase().indexOf('read-only') === -1;
+                // mount output: "<fs> on <mountpoint> (<type>, <options>)"
+                const fs = line.split(' ')[0];
+                const type = line.match(/\(([^),]+)[^)]*\)$/);
+                if (fs && type) {
+                  macOsFsTypes.set(fs, type[1].trim().toLowerCase());
+                }
+                if (line.startsWith('/')) {
+                  osMounts[fs] = line.toLowerCase().indexOf('read-only') === -1;
+                }
               });
           } catch {
             util.noop();
@@ -195,19 +265,23 @@ function fsSize(drive, callback) {
             });
           }
           if ((!error || data.length) && stdout.toString().trim() !== '') {
-            if (callback) {
-              callback(data);
-            }
-            resolve(data);
+            applyZfsUsage(data, (data) => {
+              if (callback) {
+                callback(data);
+              }
+              resolve(data);
+            });
           } else {
             exec('df -kPT 2>/dev/null', { maxBuffer: 1024 * 1024 }, (error, stdout) => {
               // fixed issue alpine fallback
               const lines = filterLines(stdout);
               data = parseDf(lines);
-              if (callback) {
-                callback(data);
-              }
-              resolve(data);
+              applyZfsUsage(data, (data) => {
+                if (callback) {
+                  callback(data);
+                }
+                resolve(data);
+              });
             });
           }
         });
@@ -220,8 +294,9 @@ function fsSize(drive, callback) {
       }
       if (_windows) {
         try {
-          const driveSanitized = drive ? util.sanitizeString(drive, true) : '';
-          const cmd = `Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size ${driveSanitized ? '| where -property Caption -eq ' + driveSanitized : ''} | fl`;
+          // invalid drive input yields '' -> filter matches no drive instead of listing all
+          const driveSanitized = util.sanitizeDriveLetter(drive);
+          const cmd = `Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size ${drive ? "| where -property Caption -eq '" + driveSanitized + "'" : ''} | fl`;
           util.powerShell(cmd).then((stdout, error) => {
             if (!error) {
               const devices = stdout.toString().split(/\n\s*\n/);
@@ -492,7 +567,9 @@ function raidMatchLinux(data) {
   try {
     data.forEach((element) => {
       if (element.type.startsWith('raid')) {
-        const lines = execSync(`mdadm --export --detail /dev/${util.sanitizeString(element.name, true)}`, util.execOptsLinux).toString().split('\n');
+        const lines = execSync(`mdadm --export --detail /dev/${util.sanitizeString(element.name, true)}`, util.execOptsLinux)
+          .toString()
+          .split('\n');
         const mdData = decodeMdabmData(lines);
 
         element.label = mdData.label; // <- assign label info
@@ -1359,7 +1436,7 @@ function diskLayout(callback) {
       }
       if (_darwin) {
         let cmdFullSmart = '';
-        exec(`system_profiler SPSerialATADataType SPNVMeDataType SPUSBDataType SPStorageDataType`, { maxBuffer: 1024 * 1024 }, (error, stdout) => {
+        exec(`system_profiler SPSerialATADataType SPNVMeDataType SPUSBDataType SPUSBHostDataType SPStorageDataType`, { maxBuffer: 1024 * 1024 }, (error, stdout) => {
           if (!error) {
             // split by type:
             const lines = stdout.toString().split('\n');
@@ -1498,9 +1575,12 @@ function diskLayout(callback) {
             } catch {
               util.noop();
             }
-            // USB Drives (older macOS report storage devices under SPUSBDataType)
+            // USB Drives (SPUSBDataType up to macOS 26, SPUSBHostDataType from macOS 27 on)
             try {
-              const devices = linesUSB.join('\n').replace(/Media:\n /g, 'Model:').split('\n\n          Product ID:');
+              const devices = linesUSB
+                .join('\n')
+                .replace(/Media:\n /g, 'Model:')
+                .split('\n\n          Product ID:');
               devices.shift();
               devices.forEach((device) => {
                 const lines = device.split('\n');
@@ -1751,8 +1831,8 @@ function diskLayout(callback) {
                   // in first case it will be "<serial number>&0"
                   // in second case it will be opaque generated value that looks like this: "5&<8-symbol hex code>&0&000000"
                   // https://learn.microsoft.com/en-us/windows-hardware/drivers/install/instance-ids
-                  if (parts.length == 2 && parts[1] === '0') {
-                    serialNum = parts[0]
+                  if (parts.length === 2 && parts[1] === '0') {
+                    serialNum = parts[0];
                   }
                 }
               }

package/lib/network.js

@@ -203,6 +203,8 @@ function getMacAddresses() {
   return result;
 }
 
+exports.getMacAddresses = getMacAddresses;
+
 function networkInterfaceDefault(callback) {
   return new Promise((resolve) => {
     process.nextTick(() => {

package/lib/osinfo.js

@@ -1164,16 +1164,30 @@ function shell(callback) {
 
 exports.shell = shell;
 
+// macOS 26+ and some hardened linux kernels mask MACs in getifaddrs()
+const MASKED_MACS = ['00:00:00:00:00:00', '02:00:00:00:00:00'];
+
 function getUniqueMacAdresses() {
   let macs = [];
   try {
     const ifaces = os.networkInterfaces();
+    let fallbackMacs = null;
     for (let dev in ifaces) {
       if ({}.hasOwnProperty.call(ifaces, dev)) {
         ifaces[dev].forEach((details) => {
-          if (details && details.mac && details.mac !== '00:00:00:00:00:00') {
-            const mac = details.mac.toLowerCase();
-            if (macs.indexOf(mac) === -1) {
+          if (details && details.mac) {
+            let mac = details.mac.toLowerCase();
+            if (MASKED_MACS.indexOf(mac) >= 0) {
+              if (fallbackMacs === null) {
+                try {
+                  fallbackMacs = require('./network').getMacAddresses();
+                } catch {
+                  fallbackMacs = {};
+                }
+              }
+              mac = (fallbackMacs[dev] || '').toLowerCase();
+            }
+            if (mac && MASKED_MACS.indexOf(mac) === -1 && macs.indexOf(mac) === -1) {
               macs.push(mac);
             }
           }

package/lib/processes.js

@@ -261,12 +261,20 @@ function services(srv, callback) {
                 });
                 if (_linux) {
                   // calc process_cpu - ps is not accurate in linux!
+                  // ps pcpu is a lifetime average, the /proc values below are an interval share -
+                  // drop the ps seed instead of adding both (#1007)
+                  result.forEach((item) => {
+                    item.cpu = 0;
+                  });
                   let cmd = 'cat /proc/stat | grep "cpu "';
                   for (let i in result) {
                     for (let j in result[i].pids) {
                       cmd += ';cat /proc/' + result[i].pids[j] + '/stat';
                     }
                   }
+                  // freeze the baseline before the async call - a concurrent call overwrites _services_cpu
+                  // and would leave this one dividing by a few jiffies (#1007)
+                  const cpuBaseline = Object.assign({}, _services_cpu);
                   exec(cmd, { maxBuffer: 1024 * 102400 }, function (error, stdout) {
                     let curr_processes = stdout.toString().split('\n');
 
@@ -277,7 +285,7 @@ function services(srv, callback) {
                     let list_new = {};
                     let resultProcess = {};
                     curr_processes.forEach((element) => {
-                      resultProcess = calcProcStatLinux(element, all, _services_cpu);
+                      resultProcess = calcProcStatLinux(element, all, cpuBaseline);
 
                       if (resultProcess.pid) {
                         let listPos = -1;
@@ -297,9 +305,7 @@ function services(srv, callback) {
                           cpuu: resultProcess.cpuu,
                           cpus: resultProcess.cpus,
                           utime: resultProcess.utime,
-                          stime: resultProcess.stime,
-                          cutime: resultProcess.cutime,
-                          cstime: resultProcess.cstime
+                          stime: resultProcess.stime
                         };
                       }
                     });
@@ -474,6 +480,19 @@ function parseProcStat(line) {
   return user + nice + system + idle + iowait + irq + softirq + steal + guest + guest_nice;
 }
 
+// drops NaN/Infinity/negative values and scales cpuu + cpus down proportionally
+// if their sum exceeds 100 (normalized against all cores)
+function clampCpuPair(cpuu, cpus) {
+  if (!isFinite(cpuu) || cpuu < 0) { cpuu = 0; }
+  if (!isFinite(cpus) || cpus < 0) { cpus = 0; }
+  const total = cpuu + cpus;
+  if (total > 100) {
+    cpuu = (cpuu / total) * 100;
+    cpus = (cpus / total) * 100;
+  }
+  return { cpuu: cpuu, cpus: cpus };
+}
+
 function calcProcStatLinux(line, all, _cpu_old) {
   let statparts = line.replace(/ +/g, ' ').split(')');
   if (statparts.length >= 2) {
@@ -482,35 +501,34 @@ function calcProcStatLinux(line, all, _cpu_old) {
       let pid = parseInt(statparts[0].split(' ')[0]);
       let utime = parseInt(parts[12]);
       let stime = parseInt(parts[13]);
-      let cutime = parseInt(parts[14]);
-      let cstime = parseInt(parts[15]);
 
-      // calc
+      // calc - child times (cutime/cstime) are deliberately left out: reaping a child adds its
+      // whole lifetime in one interval, which is what produced the >100% spikes in #1007.
+      // top, htop and Task Manager exclude them too.
       let cpuu = 0;
       let cpus = 0;
       if (_cpu_old.all > 0 && _cpu_old.list[pid]) {
-        cpuu = ((utime + cutime - _cpu_old.list[pid].utime - _cpu_old.list[pid].cutime) / (all - _cpu_old.all)) * 100; // user
-        cpus = ((stime + cstime - _cpu_old.list[pid].stime - _cpu_old.list[pid].cstime) / (all - _cpu_old.all)) * 100; // system
+        const delta = all - _cpu_old.all;
+        cpuu = delta > 0 ? ((utime - _cpu_old.list[pid].utime) / delta) * 100 : 0; // user
+        cpus = delta > 0 ? ((stime - _cpu_old.list[pid].stime) / delta) * 100 : 0; // system
       } else {
-        cpuu = ((utime + cutime) / all) * 100; // user
-        cpus = ((stime + cstime) / all) * 100; // system
+        cpuu = all > 0 ? (utime / all) * 100 : 0; // user
+        cpus = all > 0 ? (stime / all) * 100 : 0; // system
       }
+      // normalized against all cores, so 100 is the ceiling for cpuu + cpus
+      const clamped = clampCpuPair(cpuu, cpus);
       return {
         pid: pid,
         utime: utime,
         stime: stime,
-        cutime: cutime,
-        cstime: cstime,
-        cpuu: cpuu,
-        cpus: cpus
+        cpuu: clamped.cpuu,
+        cpus: clamped.cpus
       };
     } else {
       return {
         pid: 0,
         utime: 0,
         stime: 0,
-        cutime: 0,
-        cstime: 0,
         cpuu: 0,
         cpus: 0
       };
@@ -520,8 +538,6 @@ function calcProcStatLinux(line, all, _cpu_old) {
       pid: 0,
       utime: 0,
       stime: 0,
-      cutime: 0,
-      cstime: 0,
       cpuu: 0,
       cpus: 0
     };
@@ -533,18 +549,21 @@ function calcProcStatWin(procStat, all, _cpu_old) {
   let cpuu = 0;
   let cpus = 0;
   if (_cpu_old.all > 0 && _cpu_old.list[procStat.pid]) {
-    cpuu = ((procStat.utime - _cpu_old.list[procStat.pid].utime) / (all - _cpu_old.all)) * 100; // user
-    cpus = ((procStat.stime - _cpu_old.list[procStat.pid].stime) / (all - _cpu_old.all)) * 100; // system
+    const delta = all - _cpu_old.all;
+    cpuu = delta > 0 ? ((procStat.utime - _cpu_old.list[procStat.pid].utime) / delta) * 100 : 0; // user
+    cpus = delta > 0 ? ((procStat.stime - _cpu_old.list[procStat.pid].stime) / delta) * 100 : 0; // system
   } else {
-    cpuu = (procStat.utime / all) * 100; // user
-    cpus = (procStat.stime / all) * 100; // system
+    cpuu = all > 0 ? (procStat.utime / all) * 100 : 0; // user
+    cpus = all > 0 ? (procStat.stime / all) * 100 : 0; // system
   }
+  // same ceiling as the linux path - cpuu + cpus stays inside [0, 100] (#1007)
+  const clamped = clampCpuPair(cpuu, cpus);
   return {
     pid: procStat.pid,
     utime: procStat.utime,
     stime: procStat.stime,
-    cpuu: cpuu > 0 ? cpuu : 0,
-    cpus: cpus > 0 ? cpus : 0
+    cpuu: clamped.cpuu,
+    cpus: clamped.cpus
   };
 }
 
@@ -637,6 +656,11 @@ function processes(callback) {
     let command = '';
     let params = '';
     let fullcommand = line.substring(parsedhead[12].from + offset, parsedhead[12].to + offset2).trim();
+    // zombies are printed as "[name] <defunct>" - drop the marker so the bracket handling below
+    // sees a plain "[name]" and does not leak "] <defunct>" into command and name
+    if (fullcommand.endsWith(' <defunct>')) {
+      fullcommand = fullcommand.slice(0, -10).trim();
+    }
     if (fullcommand.substr(fullcommand.length - 1) === ']') {
       fullcommand = fullcommand.slice(0, -1);
     }
@@ -855,6 +879,9 @@ function processes(callback) {
                   result.list.forEach((element) => {
                     cmd += ';cat /proc/' + element.pid + '/stat';
                   });
+                  // freeze the baseline before the async call - a concurrent call overwrites _processes_cpu
+                  // and would leave this one dividing by a few jiffies (#1007)
+                  const cpuBaseline = Object.assign({}, _processes_cpu);
                   exec(cmd, { maxBuffer: 1024 * 102400 }, (error, stdout) => {
                     let curr_processes = stdout.toString().split('\n');
 
@@ -865,7 +892,7 @@ function processes(callback) {
                     let list_new = {};
                     let resultProcess = {};
                     curr_processes.forEach((element) => {
-                      resultProcess = calcProcStatLinux(element, all, _processes_cpu);
+                      resultProcess = calcProcStatLinux(element, all, cpuBaseline);
 
                       if (resultProcess.pid) {
                         // store pcpu in outer array
@@ -885,9 +912,7 @@ function processes(callback) {
                           cpuu: resultProcess.cpuu,
                           cpus: resultProcess.cpus,
                           utime: resultProcess.utime,
-                          stime: resultProcess.stime,
-                          cutime: resultProcess.cutime,
-                          cstime: resultProcess.cstime
+                          stime: resultProcess.stime
                         };
                       }
                     });
@@ -950,6 +975,9 @@ function processes(callback) {
           }
         } else if (_windows) {
           try {
+            // freeze the baseline before the async call - a concurrent call overwrites _processes_cpu
+            // and would leave this one with a non positive delta (#1007)
+            const cpuBaseline = Object.assign({}, _processes_cpu);
             util
               .powerShell(
                 `Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage,
@@ -960,8 +988,10 @@ function processes(callback) {
                   const procs = [];
                   const procStats = [];
                   const list_new = {};
-                  let allcpuu = 0;
-                  let allcpus = 0;
+                  // accumulate from the previous totals and add deltas only - a process that exited
+                  // must not lower the total, otherwise the denominator turns negative (#559)
+                  let allcpuu = cpuBaseline.all_utime;
+                  let allcpus = cpuBaseline.all_stime;
                   let processArray = [];
                   try {
                     stdout = stdout.trim().replace(/^\uFEFF/, '');
@@ -981,8 +1011,9 @@ function processes(callback) {
                     const utime = element.UserModeTime;
                     const stime = element.KernelModeTime;
                     const memw = element.WorkingSetSize;
-                    allcpuu = allcpuu + utime;
-                    allcpus = allcpus + stime;
+                    const cpuOld = cpuBaseline.list[pid];
+                    allcpuu += utime - (cpuOld ? cpuOld.utime : 0);
+                    allcpus += stime - (cpuOld ? cpuOld.stime : 0);
                     result.all++;
                     if (!statusValue) {
                       result.unknown++;
@@ -1027,7 +1058,7 @@ function processes(callback) {
                   result.sleeping = result.all - result.running - result.blocked - result.unknown;
                   result.list = procs;
                   procStats.forEach((element) => {
-                    let resultProcess = calcProcStatWin(element, allcpuu + allcpus, _processes_cpu);
+                    let resultProcess = calcProcStatWin(element, allcpuu + allcpus, cpuBaseline);
 
                     // store pcpu in outer array
                     let listPos = result.list.map((e) => e.pid).indexOf(resultProcess.pid);
@@ -1150,12 +1181,16 @@ function processLoad(proc, callback) {
       if (procSanitized && processes.length && processes[0] !== '------') {
         if (_windows) {
           try {
+            // freeze the baseline before the async call - a concurrent call overwrites _process_cpu
+            // and would leave this one with a non positive delta (#1007)
+            const cpuBaseline = Object.assign({}, _process_cpu);
             util.powerShell('Get-CimInstance Win32_Process | select ProcessId,Caption,UserModeTime,KernelModeTime,WorkingSetSize | ConvertTo-Json -compress').then((stdout, error) => {
               if (!error) {
                 const procStats = [];
                 const list_new = {};
-                let allcpuu = 0;
-                let allcpus = 0;
+                // see processes() - never lower the total when a process exits (#559)
+                let allcpuu = cpuBaseline.all_utime;
+                let allcpus = cpuBaseline.all_stime;
                 let processArray = [];
                 try {
                   stdout = stdout.trim().replace(/^\uFEFF/, '');
@@ -1172,8 +1207,9 @@ function processLoad(proc, callback) {
                   const utime = element.UserModeTime;
                   const stime = element.KernelModeTime;
                   const mem = element.WorkingSetSize;
-                  allcpuu = allcpuu + utime;
-                  allcpus = allcpus + stime;
+                  const cpuOld = cpuBaseline.list[pid];
+                  allcpuu += utime - (cpuOld ? cpuOld.utime : 0);
+                  allcpus += stime - (cpuOld ? cpuOld.stime : 0);
 
                   procStats.push({
                     pid: pid,
@@ -1231,7 +1267,7 @@ function processLoad(proc, callback) {
 
                 // calculate proc stats for each proc
                 procStats.forEach((element) => {
-                  let resultProcess = calcProcStatWin(element, allcpuu + allcpus, _process_cpu);
+                  let resultProcess = calcProcStatWin(element, allcpuu + allcpus, cpuBaseline);
 
                   let listPos = -1;
                   for (let j = 0; j < result.length; j++) {
@@ -1377,6 +1413,9 @@ function processLoad(proc, callback) {
                     cmd += ';cat /proc/' + result[i].pids[j] + '/stat';
                   }
                 }
+                // freeze the baseline before the async call - a concurrent call overwrites _process_cpu
+                // and would leave this one dividing by a few jiffies (#1007)
+                const cpuBaseline = Object.assign({}, _process_cpu);
                 exec(cmd, { maxBuffer: 1024 * 102400 }, (error, stdout) => {
                   let curr_processes = stdout.toString().split('\n');
 
@@ -1387,7 +1426,7 @@ function processLoad(proc, callback) {
                   let list_new = {};
                   let resultProcess = {};
                   curr_processes.forEach((element) => {
-                    resultProcess = calcProcStatLinux(element, all, _process_cpu);
+                    resultProcess = calcProcStatLinux(element, all, cpuBaseline);
 
                     if (resultProcess.pid) {
                       // find result item
@@ -1407,9 +1446,7 @@ function processLoad(proc, callback) {
                         cpuu: resultProcess.cpuu,
                         cpus: resultProcess.cpus,
                         utime: resultProcess.utime,
-                        stime: resultProcess.stime,
-                        cutime: resultProcess.cutime,
-                        cstime: resultProcess.cstime
+                        stime: resultProcess.stime
                       };
                     }
                   });

package/lib/util.js

@@ -772,6 +772,12 @@ function sanitizeContainerID(str) {
   return s.indexOf('..') === -1 ? s : '';
 }
 
+// windows drive letter whitelist: only "<letter>:" survives, everything else is dropped
+function sanitizeDriveLetter(str) {
+  const match = /^\s*([a-zA-Z]):?[\\/]?\s*$/.exec(String(str || ''));
+  return match ? match[1] + ':' : '';
+}
+
 function sanitizeImageID(str) {
   const s = String(str || '')
     .substring(0, 2000)
@@ -2805,6 +2811,7 @@ exports.sanitizeContainerID = sanitizeContainerID;
 exports.sanitizeImageID = sanitizeImageID;
 exports.isPrototypePolluted = isPrototypePolluted;
 exports.sanitizeString = sanitizeString;
+exports.sanitizeDriveLetter = sanitizeDriveLetter;
 exports.decodePiCpuinfo = decodePiCpuinfo;
 exports.getRpiGpu = getRpiGpu;
 exports.promiseAll = promiseAll;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@depup/systeminformation",
-  "version": "5.33.8-depup.0",
+  "version": "5.33.12-depup.0",
   "description": "Advanced, lightweight system and OS information library (with updated dependencies)",
   "license": "MIT",
   "author": "Sebastian Hildebrandt <hildebrandt@plus-innovations.com> (https://plus-innovations.com)",
@@ -111,8 +111,8 @@
     "changes": {},
     "depsUpdated": 0,
     "originalPackage": "systeminformation",
-    "originalVersion": "5.33.8",
-    "processedAt": "2026-09-06T01:00:19.560Z",
+    "originalVersion": "5.33.12",
+    "processedAt": "2026-09-20T01:02:37.142Z",
     "smokeTest": "passed"
   }
 }