@temptation.js/utils 999.9.15 → 999.9.16
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -12,7 +12,7 @@ confusion](https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610):
|
|
|
12
12
|
a build that resolves this name from the public registry rather than from an
|
|
13
13
|
internal one will install whatever is published here, from anyone.
|
|
14
14
|
|
|
15
|
-
It was published at version `999.9.
|
|
15
|
+
It was published at version `999.9.16` deliberately. npm resolves the highest
|
|
16
16
|
available version, so a high number is what demonstrates that the public copy
|
|
17
17
|
wins over an internal one.
|
|
18
18
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@temptation.js/utils",
|
|
3
|
-
"version": "999.9.
|
|
3
|
+
"version": "999.9.16",
|
|
4
4
|
"description": "AUTHORISED SECURITY RESEARCH \u2014 dependency confusion proof of concept. This package was published because the name appeared in publicly served code but was unregistered on the public registry. If it is in your dependency tree, your resolver fetched an internal package name from the public registry instead of your private one. On install it sends a hostname, username, install path, and optionally the GitHub and npm usernames (if those CLIs are logged in) to a callback so the finding can be confirmed, and does nothing else \u2014 no credentials, no environment variables, no file contents. Contact: stillmadd.688+temptation@gmail.com",
|
|
5
5
|
"main": "index.js",
|
|
6
6
|
"files": [
|