Braintree-web: Dependency on the NPM package "8"

[raRaRa]

Hi all. I recently upgraded braintree-web to the latest version, and I noticed that it has a new dependency on a package called 8. https://www.npmjs.com/package/8

You can see the rise of downloads on that package because of braintree-web. What is this package used for? It looked a bit dubious to me, especially the package name and how dead it has been. Last published 5 years ago.

Thanks.

[raRaRa]

This package should not be included, it was probably accidentally added by someone. The 8 package has the file server.js that contains:

var http=require("http");
http.createServer(function(request,response){
    response.writeHead(200,{"Content-Type":"text/plain"});
    response.write("Hello World");
    response.end();
}).listen(8888);

Please remove it from deps. Thanks!

[raRaRa]

And here's the package.json in my node_modules/braintree-web:

{
  "name": "braintree-web",
  "version": "3.44.0",
  "license": "MIT",
  "main": "index.js",
  "repository": {
    "type": "git",
    "url": "[email protected]:braintree/braintree-web"
  },
  "dependencies": {
    "8": "0.0.1", <----------- PLEASE REMOVE.
    "@braintree/asset-loader": "0.2.1",
    "@braintree/browser-detection": "1.7.0",
    "@braintree/class-list": "0.1.0",
    "@braintree/iframer": "1.0.3",
    "@braintree/sanitize-url": "3.0.0",
    "@braintree/wrap-promise": "1.1.1",
    "card-validator": "6.1.0",
    "credit-card-type": "8.1.0",
    "framebus": "3.0.2",
    "inject-stylesheet": "1.0.0",
    "promise-polyfill": "8.1.0",
    "restricted-input": "1.2.7"
  },
  "browser": {
    "american-express": "./dist/browser/american-express.js",
    "apple-pay": "./dist/browser/apple-pay.js",
    "client": "./dist/browser/client.js",
    "data-collector": "./dist/browser/data-collector.js",
    "google-payment": "./dist/browser/google-payment.js",
    "hosted-fields": "./dist/browser/hosted-fields.js",
    "ideal": "./dist/browser/ideal.js",
    "local-payment": "./dist/browser/local-payment.js",
    "masterpass": "./dist/browser/masterpass.js",
    "payment-request": "./dist/browser/payment-request.js",
    "paypal": "./dist/browser/paypal.js",
    "paypal-checkout": "./dist/browser/paypal-checkout.js",
    "three-d-secure": "./dist/browser/three-d-secure.js",
    "unionpay": "./dist/browser/unionpay.js",
    "us-bank-account": "./dist/browser/us-bank-account.js",
    "vault-manager": "./dist/browser/vault-manager.js",
    "venmo": "./dist/browser/venmo.js",
    "visa-checkout": "./dist/browser/visa-checkout.js",
    "./index.js": "./dist/browser/index.js"
  },
  "description": "A suite of tools for integrating Braintree in the browser",
  "keywords": [
    "braintree",
    "payments"
  ],
  "author": "braintree <[email protected]>",
  "homepage": "https://github.com/braintree/braintree-web"
}

[crookedneighbor]

Thanks for bringing this up, looks like we accidentally installed it right before publishing the package. My guess is we were attempting to switch to node 8 with nvm (nvm install 8) and instead installed the 8 package (npm install 8) and then published it accidentally.

We'll get this fixed up.

[crookedneighbor]

3.44.1 has been released to fix this. I'm going to leave this issue open until Drop-in is released as well. (hopefully later today)

[raRaRa]

Super! Thanks a lot @crookedneighbor - much appreciated!

[crookedneighbor]

v1.17.1 of web drop-in is out now. We'll be deprecating v3.44.0 on npm shortly.