@orangemug/oops 0.1.4 → 0.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +7 -2
- package/dist/npm/bin/index.js +6 -2
- package/dist/npm/cjs/index.js +2 -2
- package/dist/npm/es/index.js +2 -2
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -1,13 +1,15 @@
|
|
|
1
1
|
# `@orangemug/oops`
|
|
2
|
+
|
|
2
3
|
Have I got a compromised pacakge in my npm/pnpm/yarn cache?
|
|
3
4
|
|
|
4
5
|
## Usage
|
|
6
|
+
|
|
5
7
|
Find out with `oops`
|
|
6
8
|
|
|
7
9
|
```bash
|
|
8
10
|
npx @orangemug/oops --help
|
|
9
11
|
# ./oops <dangerous_package_versions>
|
|
10
|
-
#
|
|
12
|
+
#
|
|
11
13
|
# Example: npx @orangemug/oops @ctrl/tinycolor:4.1.1 @ctrl/tinycolor:4.1.2
|
|
12
14
|
```
|
|
13
15
|
|
|
@@ -19,9 +21,12 @@ You can attach this command to a bug tracker ticket somewhere in your company/or
|
|
|
19
21
|
> npx @orangemug/oops \
|
|
20
22
|
> @ctrl/tinycolor:4.1.1 \
|
|
21
23
|
> @ctrl/tinycolor:4.1.2
|
|
22
|
-
> ```
|
|
24
|
+
> ```
|
|
23
25
|
|
|
24
26
|
The examples are from <https://orca.security/resources/blog/npm-malware-campaign-tinycolor/>
|
|
25
27
|
|
|
28
|
+
It also support ranges such as `^4`
|
|
29
|
+
|
|
26
30
|
## Licence
|
|
31
|
+
|
|
27
32
|
MIT
|
package/dist/npm/bin/index.js
CHANGED
|
@@ -29,7 +29,7 @@ async function npmDoesPackageExist(pkgName) {
|
|
|
29
29
|
}
|
|
30
30
|
async function yarnDoesPackageExist(pkgName) {
|
|
31
31
|
const result = await exec(`yarn cache list --pattern ${pkgName}`);
|
|
32
|
-
const items = result.stdout.split("\n").map(line => line.split(/\s+/));
|
|
32
|
+
const items = result.stdout.split("\n").map((line) => line.split(/\s+/));
|
|
33
33
|
const out = [];
|
|
34
34
|
for (const item of items) {
|
|
35
35
|
if (item[0] === pkgName) {
|
|
@@ -57,7 +57,7 @@ async function doesPackageExistInCache(pkgName, version) {
|
|
|
57
57
|
}
|
|
58
58
|
return 0;
|
|
59
59
|
});
|
|
60
|
-
const filteredVersions = sorted.filter(pkgVersion => {
|
|
60
|
+
const filteredVersions = sorted.filter((pkgVersion) => {
|
|
61
61
|
return semver.satisfies(pkgVersion, version);
|
|
62
62
|
});
|
|
63
63
|
effectedVersions[managerName] = filteredVersions;
|
|
@@ -69,6 +69,10 @@ async function run(packages) {
|
|
|
69
69
|
let hasErrors = false;
|
|
70
70
|
for (const pkg of packages) {
|
|
71
71
|
const [pkgName, version] = pkg.split(":");
|
|
72
|
+
if (version === undefined || version === "") {
|
|
73
|
+
console.error(chalk.red(`'${pkg}' doesn't contain a version, add a version, for example '${pkg}:^2' (change the semver version)`));
|
|
74
|
+
process.exit(2);
|
|
75
|
+
}
|
|
72
76
|
if (pkgName && version) {
|
|
73
77
|
const output = await doesPackageExistInCache(pkgName, version);
|
|
74
78
|
console.log(`${chalk.magenta(pkgName)}:${version}`);
|
package/dist/npm/cjs/index.js
CHANGED
|
@@ -28,7 +28,7 @@ async function npmDoesPackageExist(pkgName) {
|
|
|
28
28
|
}
|
|
29
29
|
async function yarnDoesPackageExist(pkgName) {
|
|
30
30
|
const result = await exec(`yarn cache list --pattern ${pkgName}`);
|
|
31
|
-
const items = result.stdout.split("\n").map(line => line.split(/\s+/));
|
|
31
|
+
const items = result.stdout.split("\n").map((line) => line.split(/\s+/));
|
|
32
32
|
const out = [];
|
|
33
33
|
for (const item of items) {
|
|
34
34
|
if (item[0] === pkgName) {
|
|
@@ -56,7 +56,7 @@ async function doesPackageExistInCache(pkgName, version) {
|
|
|
56
56
|
}
|
|
57
57
|
return 0;
|
|
58
58
|
});
|
|
59
|
-
const filteredVersions = sorted.filter(pkgVersion => {
|
|
59
|
+
const filteredVersions = sorted.filter((pkgVersion) => {
|
|
60
60
|
return semver.satisfies(pkgVersion, version);
|
|
61
61
|
});
|
|
62
62
|
effectedVersions[managerName] = filteredVersions;
|
package/dist/npm/es/index.js
CHANGED
|
@@ -26,7 +26,7 @@ async function npmDoesPackageExist(pkgName) {
|
|
|
26
26
|
}
|
|
27
27
|
async function yarnDoesPackageExist(pkgName) {
|
|
28
28
|
const result = await exec(`yarn cache list --pattern ${pkgName}`);
|
|
29
|
-
const items = result.stdout.split("\n").map(line => line.split(/\s+/));
|
|
29
|
+
const items = result.stdout.split("\n").map((line) => line.split(/\s+/));
|
|
30
30
|
const out = [];
|
|
31
31
|
for (const item of items) {
|
|
32
32
|
if (item[0] === pkgName) {
|
|
@@ -54,7 +54,7 @@ async function doesPackageExistInCache(pkgName, version) {
|
|
|
54
54
|
}
|
|
55
55
|
return 0;
|
|
56
56
|
});
|
|
57
|
-
const filteredVersions = sorted.filter(pkgVersion => {
|
|
57
|
+
const filteredVersions = sorted.filter((pkgVersion) => {
|
|
58
58
|
return semver.satisfies(pkgVersion, version);
|
|
59
59
|
});
|
|
60
60
|
effectedVersions[managerName] = filteredVersions;
|