Update package.json

[jadoonf]

No description provided.

[github-actions]

The following behavior was detected in the dependency tree during installation

🛑 3 critical activities detected

[email protected]

🛑 This package has inconsistent dependencies in the tarball's package.json

Dependency type

Direct dependency

Metadata

description:	The dependencies in the tarball's package.json differ from the dependencies present in the NPM registry.
path:	package.json

[email protected]

🛑 The name of this package closely resembles other package names ("ini") which are popular on NPM: it might be a typosquatting attempt

Dependency type

Direct dependency

Metadata

similars:

[ini]

[email protected]

🛑 The name of this package closely resembles other package names ("findit2") which are popular on NPM: it might be a typosquatting attempt

Dependency type

Direct dependency

Metadata

similars:

[findit2]

⚠️ 2 medium activities detected

[email protected]

⚠️ install script detected in package.json

Dependency type

Direct dependency

Metadata

description:	A package that has an install script in package.json is a potential security risk, as it can be used to execute arbitrary code on the system with the permissions of the user running npm install. This is a common attack vector for malicious packages.
path:	package.json

[email protected]

⚠️ install script detected in package.json

Dependency type

Direct dependency

Metadata

description:	A package that has an install script in package.json is a potential security risk, as it can be used to execute arbitrary code on the system with the permissions of the user running npm install. This is a common attack vector for malicious packages.
path:	package.json

🔷 2 low activities detected

[email protected]

🔷 shady link detected in package

Dependency type

Direct dependency

Metadata

description:	A package that contains a link to a shady domain is a potential security risk, as it can be used to exfiltrate sensitive information from the system. A low severity is assigned to this rule as it is not always a security risk, but it is a good practice to avoid those links.
path:	internals/collection-strong.js

[email protected]

🔷 This package version is 0.X.Y: the semver spec mandates those versions for initial development meaning that anything may change at any time and the public API of this package should not be considered stable.

Dependency type

Direct dependency

Metadata

detail:	NPM allows changes that do not modify the left-most non-zero element in the [major, minor, patch] tuple. In other words, this allows patch and minor updates for versions 1.0.0 and above, patch updates for versions 0.X >= 0.1.0, and no updates for versions 0.0.X. So, if you depend on ^0.5.21, npm update won't update it to 0.6.0, because only patch updates are allowed.
detail_link:	https://lstn.dev/semver-parser-node
reason:	0.5.21 is less than or equal to 0.x.x-0
spec:	https://lstn.dev/semver-spec-0yz

generated by listen.dev