Skip to content

Add files field to limit files installed when installed as a package#34

Open
openam wants to merge 1 commit into
moneals:masterfrom
openam:specify-files
Open

Add files field to limit files installed when installed as a package#34
openam wants to merge 1 commit into
moneals:masterfrom
openam:specify-files

Conversation

@openam
Copy link
Copy Markdown

@openam openam commented Mar 15, 2024

Since the utils is included when I install this package I'm getting some vulnerabilities showing up in some scans. I know they are not used via the NPM package so it would be nice to just exclude them from the installed package.

$ npm pack --dry-run                                                            
npm notice 
npm notice 📦  addresser@1.1.19
npm notice === Tarball Contents === 
npm notice 1.1kB   LICENSE                  
npm notice 6.2kB   README.md                
npm notice 43.9kB  data/ca-cities.json      
npm notice 314B    data/ca-states.json      
npm notice 384.7kB data/cities.json         
npm notice 1.1kB   data/states.json         
npm notice 340.8kB data/us-cities.json      
npm notice 1.2kB   data/us-states.json      
npm notice 14.5kB  data/us-street-types.json
npm notice 13.9kB  index.js                 
npm notice 889B    package.json             
npm notice === Tarball Details === 
npm notice name:          addresser                               
npm notice version:       1.1.19                                  
npm notice filename:      addresser-1.1.19.tgz                    
npm notice package size:  292.0 kB                                
npm notice unpacked size: 808.6 kB                                
npm notice shasum:        cae204a2d17f8d881d181318f3bd15bcdae1ad10
npm notice integrity:     sha512-zuzIV/VDji+DS[...]lpdGCE6JvpkFQ==
npm notice total files:   11                                      
npm notice 
addresser-1.1.19.tgz

Vulnerability scan findings:

image image image image

sokol8 added a commit to Repliers-io/addresser that referenced this pull request Aug 29, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant