fix(security): replace kill-port pkg with native zero-dependency script - #7
Merged
Merged
Conversation
Removed kill-port npm package which was compromised in the Shai-Hulud 2.0 supply chain attack (versions 2.0.2 & 2.0.3 contained credential harvesting malware). The 2.0.1 pin with a caret (^) could auto-upgrade to malicious versions during npm install. Replaced with kill-ports.js - a zero-dependency Node.js script using only Node built-ins (child_process, os) that works cross-platform on Windows (taskkill) and Mac/Linux (lsof/kill).
khaira777
added a commit
that referenced
this pull request
Jul 5, 2026
…ts/discounts/tax/loyalty) Integration tests (7 files, 123 assertions): - Happy path: order→discount→bill→payment→completed - Tax correctness: India GST calculation and recalculation - Payment integrity: split payments, wallet double-spend, zero-amount rejection - Order lifecycle: status transitions, cancel with PIN - Bill reconciliation: discount sync, add-items sync - Loyalty points: cashback, idempotency, wallet balance - Discount edge cases: combined discounts, max limits, addon prices Bug fixes: - #3: Add-items filters cancelled items from total recalculation - #4: Add-items syncs bill after updating order total - #5: Cancel/restore round-off formula corrected - #6: Discount endpoint wrapped in withTxn (race condition) - #7: Infinity passes validation (NaN/isFinite check) - #8: Missing amount defaults to remaining balance - #9: Amount capped at remaining balance - #11: Removing discount restores original tax - #12: Add-items preserves order-level discount - #13: Cancel/restore preserves order-level discount - #14: Item-level discount checks max settings - #15: Item-level discount syncs to bill - #17: Cancel/restore wrapped in withTxn - #20: Cashback calculated on discounted subtotal - #23: Quantity/price validation on order creation Shared test helper (tests/helpers/test-setup.ts): - Extracts 40 lines of boilerplate per test file - Provides: initTestDb, createApp, startServer, seed helpers, assert utilities Co-Authored-By: Claude <noreply@anthropic.com>
khaira777
pushed a commit
that referenced
this pull request
Jul 6, 2026
fix(security): replace kill-port pkg with native zero-dependency script
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Removed kill-port npm package which was compromised in the Shai-Hulud 2.0 supply chain attack (versions 2.0.2 & 2.0.3 contained credential harvesting malware). The 2.0.1 pin with a caret (^) could auto-upgrade to malicious versions during npm install.
Replaced with kill-ports.js - a zero-dependency Node.js script using only Node built-ins (child_process, os) that works cross-platform on Windows (taskkill) and Mac/Linux (lsof/kill).