diff --git a/FLAGS.md b/FLAGS.md index 62aad2b..24feef0 100644 --- a/FLAGS.md +++ b/FLAGS.md @@ -93,7 +93,7 @@ Under the hood we use the npm package [is-minified-code](https://github.com/Mart Files can be found in the **Minified Files** list items of the left menu. -![](https://i.imgur.com/e8BbBeb.png)
👀 hasMissingOrUnusedDependency +![](https://i.imgur.com/e8BbBeb.png)
👀 hasMissingOrUnusedDependency The package has a missing dependency (in package.json) or a dependency that is not used in the code (this may happen if the AST Analysis fail!) @@ -171,7 +171,7 @@ For more information on deprecation please check the official [npm documentation Indicate that the package is **also used somewhere else in the dependency tree** but with a different version (like in the screenshot with **yallist**). -![](https://camo.githubusercontent.com/933ca23e59bb1ed0159a7b444b783ce740224426/68747470733a2f2f7265732e636c6f7564696e6172792e636f6d2f70726163746963616c6465762f696d6167652f66657463682f732d2d43477a4e5f4977362d2d2f635f6c696d6974253243665f6175746f253243666c5f70726f6772657373697665253243715f6175746f253243775f3838302f68747470733a2f2f692e696d6775722e636f6d2f3730796e6674542e706e67)
☁️ isGit +![](https://camo.githubusercontent.com/933ca23e59bb1ed0159a7b444b783ce740224426/68747470733a2f2f7265732e636c6f7564696e6172792e636f6d2f70726163746963616c6465762f696d6167652f66657463682f732d2d43477a4e5f4977362d2d2f635f6c696d6974253243665f6175746f253243666c5f70726f6772657373697665253243715f6175746f253243775f3838302f68747470733a2f2f692e696d6775722e636f6d2f3730796e6674542e706e67)
☁️ isGit The project has been detected as a GIT repository. Sometimes a dependency on the package.json link to a GIT repository, example: diff --git a/scripts/generateFlags.js b/scripts/generateFlags.js index 0cafc90..05e5298 100644 --- a/scripts/generateFlags.js +++ b/scripts/generateFlags.js @@ -18,13 +18,13 @@ const allFlagsContent = await Promise.all( const turndownService = new TurndownService(); -turndownService.addRule("summary", { - filter: "summary", +turndownService.addRule("h1", { + filter: "h1", replacement: (content) => `${content}` }); -turndownService.addRule("details", { - filter: "details", +turndownService.addRule("div", { + filter: "div", replacement: (content) => `
${content}
` }); diff --git a/src/flags/hasBannedFile.html b/src/flags/hasBannedFile.html index 1942a7e..a2dc05d 100644 --- a/src/flags/hasBannedFile.html +++ b/src/flags/hasBannedFile.html @@ -1,5 +1,5 @@ -
- 🌍 hasBannedFile +
+

🌍 hasBannedFile

The project has at least one sensitive file (or a file with sensitive information in it).

@@ -12,5 +12,5 @@
  • .env
  • files with extension like .key or .pem
    • -
    + diff --git a/src/flags/hasCustomResolver.html b/src/flags/hasCustomResolver.html index 954f52e..8d2a01b 100644 --- a/src/flags/hasCustomResolver.html +++ b/src/flags/hasCustomResolver.html @@ -1,5 +1,5 @@ -
    - 💎 hasCustomResolver +
    +

    💎 hasCustomResolver

    The package has custom dependencies resolver such as +git or +ssh or a local file with file:. In this kind of case it is better to check the package.json. @@ -13,4 +13,4 @@ Documentation: npm-install

    -
    \ No newline at end of file + \ No newline at end of file diff --git a/src/flags/hasExternalCapacity.html b/src/flags/hasExternalCapacity.html index be170ce..aef942b 100644 --- a/src/flags/hasExternalCapacity.html +++ b/src/flags/hasExternalCapacity.html @@ -1,5 +1,5 @@ -
    - 🌍 hasExternalCapacity +
    +

    🌍 hasExternalCapacity

    The package use a Node.js core package that allow to access the network. These core package are: @@ -14,5 +14,5 @@

    ⚠️ This flag only work if the AST analysis as successfully retrieved all dependencies as expected.

    -
    + diff --git a/src/flags/hasIndirectDependencies.html b/src/flags/hasIndirectDependencies.html index 55d664f..fa532db 100644 --- a/src/flags/hasIndirectDependencies.html +++ b/src/flags/hasIndirectDependencies.html @@ -1,5 +1,5 @@ -
    - 🌲 hasIndirectDependencies +
    +

    🌲 hasIndirectDependencies

    The package has indirect (or also called transitive) dependencies. This means that the child dependencies of the package also have dependencies. @@ -50,4 +50,4 @@ > -

    \ No newline at end of file + \ No newline at end of file diff --git a/src/flags/hasManyPublishers.html b/src/flags/hasManyPublishers.html index 9536829..52ce85c 100644 --- a/src/flags/hasManyPublishers.html +++ b/src/flags/hasManyPublishers.html @@ -1,8 +1,8 @@ -
    - 👥 hasManyPublishers +
    +

    👥 hasManyPublishers

    The package has been published on npm by multiple unique users. There is no big deal here, just mean the package is maintained by a group of people.

    -
    + diff --git a/src/flags/hasMinifiedCode.html b/src/flags/hasMinifiedCode.html index 0083d80..cca836f 100644 --- a/src/flags/hasMinifiedCode.html +++ b/src/flags/hasMinifiedCode.html @@ -1,5 +1,5 @@ -
    - 🔬 hasMinifiedCode +
    +

    🔬 hasMinifiedCode

    Has one or many files that has been detected as minified JavaScript code. We use a package that will tell us if the code is minified (in case the file as @@ -25,4 +25,4 @@

    Files can be found in the Minified Files list items of the left menu.


    -
    + diff --git a/src/flags/hasMissingOrUnusedDependency.html b/src/flags/hasMissingOrUnusedDependency.html index e4fa512..c4e1d60 100644 --- a/src/flags/hasMissingOrUnusedDependency.html +++ b/src/flags/hasMissingOrUnusedDependency.html @@ -1,6 +1,6 @@ -
    - 👀 hasMissingOrUnusedDependency +
    +

    👀 hasMissingOrUnusedDependency

    The package has a missing dependency (in package.json) or a dependency that is not used in the code (this may happen if the AST Analysis fail!)

    -
    + diff --git a/src/flags/hasMultipleLicenses.html b/src/flags/hasMultipleLicenses.html index c5d5c9d..0b3476e 100644 --- a/src/flags/hasMultipleLicenses.html +++ b/src/flags/hasMultipleLicenses.html @@ -1,5 +1,5 @@ -
    - 📚 hasMultipleLicenses +
    +

    📚 hasMultipleLicenses

    We have detected different licenses in package.json and other licenses files (LICENSE, @@ -16,4 +16,4 @@

    Under the hood we use conformance to parse licenses !

    -
    + diff --git a/src/flags/hasNativeCode.html b/src/flags/hasNativeCode.html index 59f1565..39cfeab 100644 --- a/src/flags/hasNativeCode.html +++ b/src/flags/hasNativeCode.html @@ -1,5 +1,5 @@ -
    - 🐲 hasNativeCode +
    +

    🐲 hasNativeCode

    The package use native components (package, file, configuration) like binding.gyp or npm package for native addon like node-addon-api.

    @@ -12,4 +12,4 @@
  • - One of the package dependency is known for building native addons.
  • - The package.json file has the property "gypfile" set to true.
    • -
    + diff --git a/src/flags/hasNoLicense.html b/src/flags/hasNoLicense.html index a6fbe5c..276ccc8 100644 --- a/src/flags/hasNoLicense.html +++ b/src/flags/hasNoLicense.html @@ -1,5 +1,5 @@ -
    - 📜 hasNoLicense +
    +

    📜 hasNoLicense

    This flag mean that we have not detected any licenses in the npm Tarball (or something went wrong in the detection). For detecting licenses we are reading @@ -21,4 +21,4 @@

    ⚠️ we are working to stabilize this flag !

    -
    + diff --git a/src/flags/hasScript.html b/src/flags/hasScript.html index 3edff82..5f9fef1 100644 --- a/src/flags/hasScript.html +++ b/src/flags/hasScript.html @@ -1,5 +1,5 @@ -
    - 📦 hasScript +
    +

    📦 hasScript

    The package has pre and/or post script in the package.json file. These script will be executed before or @@ -23,4 +23,4 @@ > -

    + diff --git a/src/flags/hasWarnings.html b/src/flags/hasWarnings.html index e756b2f..53fe8cc 100644 --- a/src/flags/hasWarnings.html +++ b/src/flags/hasWarnings.html @@ -1,8 +1,8 @@ -
    - ⚠ hasWarnings +
    +

    ⚠ hasWarnings

    This means that the SAST Scanner has detected several problems by analyzing the Abstract Syntax Tree (AST) of a JavaScript source code. All warnings are accurately documented here.

    -
    + diff --git a/src/flags/isDead.html b/src/flags/isDead.html index b069161..f0e256f 100644 --- a/src/flags/isDead.html +++ b/src/flags/isDead.html @@ -1,5 +1,5 @@ -
    - 💀 isDead +
    +

    💀 isDead

    The dependency (package) has not received update from at least one year and has at least one dependency that need to be updated.

    @@ -7,4 +7,4 @@

    It probably means it's dangerous to use (or continue to) because the author doesn't seem to update the package anymore (even worst if you want him to implement a new version / security patch).

    -
    + diff --git a/src/flags/isDeprecated.html b/src/flags/isDeprecated.html index ac04190..7c1cdd7 100644 --- a/src/flags/isDeprecated.html +++ b/src/flags/isDeprecated.html @@ -1,5 +1,5 @@ -
    - ⛔️ isDeprecated +
    +

    ⛔️ isDeprecated

    The given npm package has been deprecated by his author (it must be updated or replaced with an equivalent if there is no new version available). @@ -13,4 +13,4 @@ >npm documentation.

    -
    + diff --git a/src/flags/isDuplicated.html b/src/flags/isDuplicated.html index 1dca02a..4f48883 100644 --- a/src/flags/isDuplicated.html +++ b/src/flags/isDuplicated.html @@ -1,8 +1,8 @@ -
    - 🎭 isDuplicate +
    +

    🎭 isDuplicate

    Indicate that the package is also used somewhere else in the dependency tree but with a different version (like in the screenshot with yallist).


    -
    \ No newline at end of file + \ No newline at end of file diff --git a/src/flags/isGit.html b/src/flags/isGit.html index 0d9d919..095975a 100644 --- a/src/flags/isGit.html +++ b/src/flags/isGit.html @@ -1,5 +1,5 @@ -
    - ☁️ isGit +
    +

    ☁️ isGit

    The project has been detected as a GIT repository. Sometimes a dependency on the package.json link to a GIT repository, example: @@ -12,4 +12,4 @@ pacote to fetch and extract packages we are supporting this given pattern.

    -
    + diff --git a/src/flags/isOutdated.html b/src/flags/isOutdated.html index 73fde83..2484d3c 100644 --- a/src/flags/isOutdated.html +++ b/src/flags/isOutdated.html @@ -1,5 +1,5 @@ -
    - ⌚️ isOutdated +
    +

    ⌚️ isOutdated

    The current package version is not equal to the latest version of the package (Compared to the versions we retrieve from the npm registry).

    @@ -12,4 +12,4 @@
  • @beta
  • @next
    • -
    + diff --git a/src/flags/vulnerabilities.html b/src/flags/vulnerabilities.html index d1d8db1..c51addf 100644 --- a/src/flags/vulnerabilities.html +++ b/src/flags/vulnerabilities.html @@ -1,5 +1,5 @@ -
    - 🚨 Vulnerabilities +
    +

    🚨 Vulnerabilities

    Vulnerabilities has been detected for the given package version. We are fetching vulnerabilities from the official @@ -7,4 +7,4 @@ >Node.js Security-WG repository

    -
    \ No newline at end of file + \ No newline at end of file