Skip to content

Remove unused "resolve" dependency #6697

@botic

Description

@botic

The zip-it-and-ship-it package contains an unused dependency (afai could evaluate), which runs a postinstall script: ljharb-monorepo-symlink-test looks like never being used. Since the overall state of the package looks unmaintained and delicate for supply chain attacks, you might consider it for a deeper review:

⚠️  Package with lifecycle scripts detected:
   Name: ljharb-monorepo-symlink-test
   Version: 0.0.0
   Location: /Users/myself/Code/mediathek-web/node_modules/@netlify/zip-it-and-ship-it/node_modules/resolve/test/resolver/multirepo
   Scripts:
      postinstall: lerna bootstrap

It has been used here:
https://github.com/netlify/build/blob/main/packages/zip-it-and-ship-it/src/resolve.js

See this commit:
d29d023

The used package is already a fork from an original monorepo-symlink-test package, which turned out to be malicious.

It would be great to reduce the dependency footprint, especially if it's such a weird old package like ljharb-monorepo-symlink-test looks like.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions