api-platform / api-platform/create-client

[potential Security Alert] New `test-vue-app` script added in `@api-platform/client-generator@0.8.0`

Aberta
#396 0 comentários 0 reações 0 responsáveis Ver no GitHub
Linguagem predominante
TypeScript
Estrelas
376
Forks
132
Métricas de merge de PRs
Nenhum PR com merge em 30d

Descrição

A new `test-vue-app` script was detected in version `0.8.0` of the package `@api-platform/client-generator`.

**Suspicion Score:** 11/100

**Script content:**
```
rm -rf ./tmp/app && mkdir -p ./tmp/app && cd ./tmp/app && npm init -y vue@2 -- --router vue && cd ../.. && yarn --cwd ./tmp/app/vue add vuex@3 vuex-map-fields lodash && cp -R ./tmp/vue/* ./tmp/app/vue/src && cp ./templates/vue/main.js ./tmp/app/vue/src && yarn --cwd ./tmp/app/vue build && start-server-and-test 'yarn --cwd ./tmp/app/vue vite preview --host 127.0.0.1 --port 3000' http://127.0.0.1:3000/books/ 'yarn playwright test'
```
see [npm documentation on package scripts](https://docs.npmjs.com/cli/v9/using-npm/scripts) for more details.
and [the detector](https://github.com/alphaleadership/npm-check). to understand why this script might be dangerous.
to get the alert only for dangerous scripts, please visit[the telegram](https://t.me/npmalert) if you want to improve the algorythm open a pull request
This could be a security risk. Please investigate.

Guia de contribuição

Abrir o guia de contribuição

Avaliação

Esta issue ainda não foi avaliada.

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.