npm-scan-plus 1.0.1 → 1.0.3

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Chris Bunting
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -158,3 +158,7 @@ npm run lint
 ## License
 
 MIT
+
+---
+
+Developed by [Chris Bunting](https://github.com/cbuntingde) <cbuntingde@gmail.com>

package/bin/npm-scan-wrap

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
 /**
- * npm-scan wrapper - Automatically scans before and after npm install
- * Usage: npm-scan-wrap install <packages>
- *        npm-scan-wrap install
+ * npm-scan-plus wrapper - Automatically scans before and after npm install
+ * Usage: npm-scan-plus-wrap install <packages>
+ *        npm-scan-plus-wrap install
  */
 
 const { spawn } = require('child_process');
@@ -14,9 +14,16 @@ const SCANNER_PATH = path.join(__dirname, '../dist/cli/index.js');
 
 async function runScanner(args) {
   return new Promise((resolve, reject) => {
-    const scanner = spawn('node', [SCANNER_PATH, ...args], {
-      stdio: 'inherit',
-      shell: true
+    // Properly quote arguments to prevent injection
+    const safeArgs = args.map(arg => {
+      if (arg.includes(' ') || arg.includes('"') || arg.includes("'")) {
+        return `"${arg.replace(/"/g, '\\"')}"`;
+      }
+      return arg;
+    });
+
+    const scanner = spawn('node', [SCANNER_PATH, ...safeArgs], {
+      stdio: 'inherit'
     });
 
     scanner.on('close', (code) => {
@@ -28,10 +35,11 @@ async function runScanner(args) {
 
 async function runNpm(args) {
   return new Promise((resolve, reject) => {
-    const npm = process.platform === 'win32' ? 'npm.cmd' : 'npm';
-    const install = spawn(npm, args, {
+    // Use npm.cmd on Windows, avoid shell: true
+    const npmCmd = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+
+    const install = spawn(npmCmd, args, {
       stdio: 'inherit',
-      shell: true,
       env: { ...process.env, NPM_CONFIG_AUDIT: 'false' }
     });
 

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "npm-scan-plus",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "Security scanner for npm packages - pre and post-install scanning for malicious code, supply chain attacks, and obfuscated code",
   "main": "dist/lib/index.js",
   "types": "dist/lib/index.d.ts",
   "bin": {
-    "npm-scan": "./bin/npm-scan.js",
-    "npm-scan-wrap": "./bin/npm-scan-wrap"
+    "npm-scan-plus": "./bin/npm-scan.js",
+    "npm-scan-plus-wrap": "./bin/npm-scan-wrap"
   },
   "scripts": {
     "build": "tsc",