read-package-json@3.0.1, read-package-json-fast@2.0.2

5 files changed, 26 insertions, 4 deletions

diff --git a/node_modules/read-package-json-fast/index.js b/node_modules/read-package-json-fast/index.js
index cf373029d..bc1c05927 100644
--- a/node_modules/read-package-json-fast/index.js
+++ b/node_modules/read-package-json-fast/index.js
@@ -3,13 +3,20 @@ const fs = require('fs')
 const readFile = promisify(fs.readFile)
 const parse = require('json-parse-even-better-errors')
 const rpj = path => readFile(path, 'utf8')
-  .then(data => normalize(parse(data)))
+  .then(data => normalize(stripUnderscores(parse(data))))
   .catch(er => {
     er.path = path
     throw er
   })
 const normalizePackageBin = require('npm-normalize-package-bin')
 
+// do not preserve _fields set in files, they are sus
+const stripUnderscores = data => {
+  for (const key of Object.keys(data).filter(k => /^_/.test(k)))
+    delete data[key]
+  return data
+}
+
 const normalize = data => {
   add_id(data)
   fixBundled(data)
diff --git a/node_modules/read-package-json-fast/package.json b/node_modules/read-package-json-fast/package.json
index aa5f5d870..388e76595 100644
--- a/node_modules/read-package-json-fast/package.json
+++ b/node_modules/read-package-json-fast/package.json
@@ -1,6 +1,6 @@
 {
   "name": "read-package-json-fast",
-  "version": "2.0.1",
+  "version": "2.0.2",
   "description": "Like read-package-json, but faster",
   "author": "Isaac Z. Schlueter <i@izs.me> (https://izs.me)",
   "license": "ISC",
diff --git a/node_modules/read-package-json/CHANGELOG.md b/node_modules/read-package-json/CHANGELOG.md
index e63fd10f7..929900482 100644
--- a/node_modules/read-package-json/CHANGELOG.md
+++ b/node_modules/read-package-json/CHANGELOG.md
@@ -2,6 +2,16 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+<a name="3.0.1"></a>
+## [3.0.1](https://github.com/npm/read-package-json/compare/v3.0.0...v3.0.1) (2021-02-22)
+
+
+### Bug Fixes
+
+* Strip underscore prefixed fields from file contents ([ac771d8](https://github.com/npm/read-package-json/commit/ac771d8))
+
+
+
 <a name="3.0.0"></a>
 # [3.0.0](https://github.com/npm/read-package-json/compare/v2.1.2...v3.0.0) (2020-10-13)
 
diff --git a/node_modules/read-package-json/package.json b/node_modules/read-package-json/package.json
index 755dd3747..50feca72f 100644
--- a/node_modules/read-package-json/package.json
+++ b/node_modules/read-package-json/package.json
@@ -1,6 +1,6 @@
 {
   "name": "read-package-json",
-  "version": "3.0.0",
+  "version": "3.0.1",
   "author": "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me/)",
   "description": "The thing npm uses to read package.json files with semantics and defaults and validation",
   "repository": {
diff --git a/node_modules/read-package-json/read-json.js b/node_modules/read-package-json/read-json.js
index 0e91e784e..64cc3fe19 100644
--- a/node_modules/read-package-json/read-json.js
+++ b/node_modules/read-package-json/read-json.js
@@ -37,7 +37,7 @@ function readJson (file, log_, strict_, cb_) {
   }
 
   if (!log) log = function () {}
-  cb = arguments[ arguments.length - 1 ]
+  cb = arguments[arguments.length - 1]
 
   readJson_(file, log, strict, cb)
 }
@@ -95,6 +95,11 @@ function parseJson (file, er, d, log, strict, cb) {
 
   try {
     data = safeJSON(stripBOM(d))
+    for (var key in data) {
+      if (/^_/.test(key)) {
+        delete data[key]
+      }
+    }
   } catch (er) {
     data = parseIndex(d)
     if (!data) return cb(parseError(er, file))