|
| 1 | +const fs = require('fs') |
| 2 | + |
| 3 | +// Lista de versiones comprometidas conocidas (ejemplos, actualiza cuando salga la lista oficial) |
| 4 | +const compromised = { |
| 5 | + chalk: ['5.3.0', '5.3.1'], |
| 6 | + debug: ['4.3.5', '4.3.6'], |
| 7 | + 'ansi-styles': ['6.2.1'], |
| 8 | + 'strip-ansi': ['7.1.1'], |
| 9 | + 'color-convert': ['2.1.2'], |
| 10 | +} |
| 11 | + |
| 12 | +function checkYarnLock(file) { |
| 13 | + const content = fs.readFileSync(file, 'utf8') |
| 14 | + const results = [] |
| 15 | + |
| 16 | + for (const [pkg, versions] of Object.entries(compromised)) { |
| 17 | + versions.forEach((ver) => { |
| 18 | + // Yarn.lock tiene entradas tipo: chalk@^5.0.0: |
| 19 | + const regex = new RegExp(`\\n${pkg}@[^:]+:\\n[\\s\\S]*?version "\\s*${ver}\\s*"`, 'g') |
| 20 | + if (regex.test(content)) { |
| 21 | + results.push({ name: pkg, version: ver }) |
| 22 | + } |
| 23 | + }) |
| 24 | + } |
| 25 | + |
| 26 | + return results |
| 27 | +} |
| 28 | + |
| 29 | +const file = 'yarn.lock' |
| 30 | +if (!fs.existsSync(file)) { |
| 31 | + console.error(`No se encontró ${file}`) |
| 32 | + process.exit(1) |
| 33 | +} |
| 34 | + |
| 35 | +const bad = checkYarnLock(file) |
| 36 | + |
| 37 | +if (bad.length === 0) { |
| 38 | + console.log('✅ No se encontraron dependencias comprometidas.') |
| 39 | +} else { |
| 40 | + console.log('⚠️ Se encontraron dependencias comprometidas:') |
| 41 | + console.table(bad) |
| 42 | +} |
0 commit comments