Don't include test/workflow stuff in the npm package

TooTallNate / node-proxy-agent

Maps proxy protocols to `http.Agent` implementations

285 stars 69 forks source link

Don't include test/workflow stuff in the npm package #70

Closed sworisbreathing closed 1 year ago

sworisbreathing commented 3 years ago

We recently had a security audit which flagged some bundled credentials in one of our nodejs projects. After a bit of investigation, we discovered that node-proxy-agent is bundling the test/ folder during packaging, which means that ssl-cert-snakeoil.key is being shipped through npm.

It's arguably a low risk from a security standpoint, but nonetheless I thought it might be a good idea to not bundle the test folder or github actions in the npm package.

TooTallNate commented 1 year ago

This code in this repository has been moved to the proxy-agents monorepo, so I am closing this pull request. If you feel that this change is still necessary as of the latest release, feel free to open a new pull request over there.