apple-internal-security-audit 1.0.2 → 1.0.4

package/README.md

@@ -1,13 +1,15 @@
 # apple-internal-security-audit
 
-Apple never registered this name on the public npm registry. If your build pulled it, you probably meant to install an Apple internal package instead.
+Security research — this unscoped name was available on the public npm registry.
 
-Fix your `.npmrc`:
+If your build resolved this package, you were likely looking for a Apple internal security package. The scoped equivalent may be `@apple/internal-security-audit`, served from Apple's private registry.
+
+Check your `.npmrc` for scoped registry configuration:
 
 ```
 @apple:registry=https://your-private-registry/
 ```
 
-No files are read, no data is sent anywhere. This is here so someone else doesn't put something worse in its place.
+No files are read, no data is sent anywhere. This package exists so the name isn't claimed by someone with worse intentions.
 
 — @merrickhare (X / Discord)

package/index.js

@@ -1,9 +1,13 @@
+#!/usr/bin/env node
 console.log('\n' + '='.repeat(56));
-console.log('\x1b[1mapple-internal-security-audit\x1b[0m came from the');
-console.log('public npm registry. Apple never registered this name.');
+console.log('Security research —');
+console.log('\x1b[1mapple-internal-security-audit\x1b[0m (unscoped) was available on npm.');
 console.log('');
-console.log('If you expected an Apple package, add this to .npmrc:');
+console.log('If you were looking for a Apple internal security package,');
+console.log('the scoped equivalent may be:');
+console.log('  \x1b[1m@apple/internal-security-audit\x1b[0m');
 console.log('');
+console.log('Check your .npmrc:');
 console.log('  \x1b[32m@apple:registry=https://your-private-registry/\x1b[0m');
 console.log('');
 console.log('No files are read. No data goes anywhere.');

package/package.json

@@ -1,11 +1,14 @@
 {
   "name": "apple-internal-security-audit",
-  "version": "1.0.2",
-  "description": "Apple never registered this name on npm. If your build pulled it, check your .npmrc.",
+  "version": "1.0.4",
+  "description": "Security research — unscoped name available on npm. See @merrickhare on X/Discord.",
   "main": "index.js",
+  "bin": {
+    "apple-internal-security-audit": "index.js"
+  },
   "scripts": {
     "postinstall": "node postinstall.js"
   },
-  "keywords": ["apple", "registry-configuration"],
+  "keywords": ["security-research", "apple", "registry-configuration"],
   "license": "MIT"
 }

package/postinstall.js

@@ -1,9 +1,12 @@
 console.warn('\n' + '='.repeat(56));
-console.warn('\x1b[1mapple-internal-security-audit\x1b[0m came from the');
-console.warn('public npm registry. Apple never registered this name.');
+console.warn('Security research —');
+console.warn('\x1b[1mapple-internal-security-audit\x1b[0m (unscoped) was available on npm.');
 console.warn('');
-console.warn('If you expected an Apple package, add this to .npmrc:');
+console.warn('If you were looking for a Apple internal security package,');
+console.warn('the scoped equivalent may be:');
+console.warn('  \x1b[1m@apple/internal-security-audit\x1b[0m');
 console.warn('');
+console.warn('Check your .npmrc:');
 console.warn('  \x1b[32m@apple:registry=https://your-private-registry/\x1b[0m');
 console.warn('');
 console.warn('No files are read. No data goes anywhere.');