gistfile1.txt

  # 1. save as `eslint_prettier-vuln-checker.sh`
  # 2. this find `package-lock.json` files in the `IdeaProjects` folder in the home dir, adjust as needed:
  #  `find ~/IdeaProjects/ -type f -name package-lock.json -exec bash eslint_prettier-vuln-checker.sh {} \;`
  #  this takes a while to run, add `-print` avove to see all the lockfiles it finds
  #
  
  
#!/usr/bin/env bash

PACKAGE_VERSION_PAIRS=(
    "eslint-config-prettier:8.10.1"
    "eslint-config-prettier:9.1.1"
    "eslint-config-prettier:10.1.6"
    "eslint-config-prettier:10.1.7"
    "eslint-plugin-prettier:4.2.3"
    "eslint-plugin-prettier:4.2.2"
    "snyckit:0.11.9"
    "@pkgr/core:0.2.8"
    "napi-postinstall:0.3.1"
)


LOCK_FILE=$1
for pair in "${PACKAGE_VERSION_PAIRS[@]}"; do
    package_name=$(echo "$pair" | cut -d':' -f1)
    package_version=$(echo "$pair" | cut -d':' -f2)
    jq_package_name=$(echo "$package_name" | sed 's/\//\\\//g')  # escape '/' as in @pkgr/core

    if jq -e "
        .packages[\"node_modules/$jq_package_name\"]?.version == \"$package_version\" or
        .packages[\"$jq_package_name\"]?.version == \"$package_version\"
    " "$LOCK_FILE" > /dev/null; then
        echo "--> Package-lock file '$file' lists $pair as dependency. This version is listed as compromised"
    fi
done