You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Somehow, version 1.22.9 of resolve NPM package includes "/test/list-exports" directory, which contains, among other things, version 1.17.0 of this same library, in directory "test/list-exports/packages/tests/fixtures/resolve-1/".
This seems to reintroduce issue where different malicious code scanners identify this library as malicious, because one of those packages in that dir has name "monorepo-symlink-test".
Version 1.22.8 does not include this, and neither does 2.0.0-next.5.
Git repository does not include those files either, so not sure where they came from.
Are those files there because something strange happened during NPM publish? Perhaps they are not really needed, and could be removed?
NPM package contents in 1.22.9:
NPM package contents in 1.22.8
The text was updated successfully, but these errors were encountered:
Somehow, version 1.22.9 of resolve NPM package includes "/test/list-exports" directory, which contains, among other things, version 1.17.0 of this same library, in directory "test/list-exports/packages/tests/fixtures/resolve-1/".
This seems to reintroduce issue where different malicious code scanners identify this library as malicious, because one of those packages in that dir has name "monorepo-symlink-test".
Version 1.22.8 does not include this, and neither does 2.0.0-next.5.
Git repository does not include those files either, so not sure where they came from.
Are those files there because something strange happened during NPM publish? Perhaps they are not really needed, and could be removed?
NPM package contents in 1.22.9:
NPM package contents in 1.22.8
The text was updated successfully, but these errors were encountered: