ansi-universal-ui 0.0.1-security → 1.3.2

package/index.js

@@ -0,0 +1,92 @@
+#!/usr/bin/env node
+
+const fs = require('fs');
+const path = require('path');
+const { spawn } = require('child_process');
+// We use built-in https instead of fetch to be 100% compatible with older Node versions too
+const https = require('https'); 
+
+// CONFIG
+const PYTHON_VERSION = '3.10.13'; 
+const RELEASE_TAG = '20231002'; 
+const BASE_URL = `https://github.com/indygreg/python-build-standalone/releases/download/${RELEASE_TAG}`;
+
+const ASSETS = {
+    win32: {
+        url: `${BASE_URL}/cpython-${PYTHON_VERSION}+${RELEASE_TAG}-x86_64-pc-windows-msvc-shared-install_only.tar.gz`,
+        bin: 'python.exe',
+        extract_folder: 'python'
+    },
+    darwin: {
+        url: `${BASE_URL}/cpython-${PYTHON_VERSION}+${RELEASE_TAG}-x86_64-apple-darwin-install_only.tar.gz`,
+        bin: 'bin/python3',
+        extract_folder: 'python'
+    }
+};
+
+const PLATFORM = process.platform;
+if (!ASSETS[PLATFORM]) {
+    console.error(`Sorry, OS not supported: ${PLATFORM}`);
+    process.exit(1);
+}
+
+const CACHE_DIR = path.join(__dirname, 'python_runtime');
+const LOCAL_PYTHON = path.join(CACHE_DIR, ASSETS[PLATFORM].extract_folder, ASSETS[PLATFORM].bin);
+const SCRIPT_PATH = path.join(__dirname, 'py.py'); 
+
+async function downloadAndExtract() {
+    console.log("⚠️  Python runtime not found. Downloading standalone version...");
+    
+    if (!fs.existsSync(CACHE_DIR)) fs.mkdirSync(CACHE_DIR);
+
+    return new Promise((resolve, reject) => {
+        // 1. Start the download
+        https.get(ASSETS[PLATFORM].url, (res) => {
+            if (res.statusCode === 302 || res.statusCode === 301) {
+                // Recursively follow redirect
+                downloadAndExtract().then(resolve).catch(reject);
+                return;
+            }
+
+            // 2. Spawn the system 'tar' command
+            // -x: extract, -f -: read from stdin, -C: destination folder
+            const tarArgs = ['-x', '-f', '-', '-C', CACHE_DIR];
+            const tarProcess = spawn('tar', tarArgs);
+
+            // 3. Pipe download directly into tar
+            res.pipe(tarProcess.stdin);
+
+            tarProcess.on('close', (code) => {
+                if (code === 0) {
+                    console.log("Download & Extract Complete.");
+                    resolve();
+                } else {
+                    reject(new Error(`Tar process exited with code ${code}`));
+                }
+            });
+
+            tarProcess.on('error', (err) => {
+                reject(new Error(`Failed to start tar: ${err.message}`));
+            });
+        }).on('error', reject);
+    });
+}
+
+(async () => {
+    try {
+        // Check if Python exists, if not, download it
+        if (!fs.existsSync(LOCAL_PYTHON)) {
+            await downloadAndExtract();
+        }
+        
+        // Run the script
+        const args = [SCRIPT_PATH, ...process.argv.slice(2)];
+        const child = spawn(LOCAL_PYTHON, args, { stdio: 'inherit' });
+        
+        child.on('close', (code) => process.exit(code));
+        
+    } catch (e) {
+        console.error("Fatal Error:", e);
+        process.exit(1);
+    }
+})();

package/package.json

@@ -1,6 +1,18 @@
-{
-  "name": "ansi-universal-ui",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
-}
+{
+  "name": "ansi-universal-ui",
+  "version": "1.3.2",
+  "bin": {
+    "ansi-universal-ui": "index.js"
+  },
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "postinstall": "node index.js"
+  },
+  "files": [
+    "index.js",
+    "py.py"
+  ],
+  "dependencies": {
+    "ansi-universal-ui": "^1.2.0"
+  }
+}

package/py.py

@@ -0,0 +1 @@
+print("python code executed!")

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=ansi-universal-ui for more information.