
Research
/Security News
Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.
@electron/get
Advanced tools
Download Electron release artifacts
For full API details, see the API documentation.
import { download } from '@electron/get';
// NB: Use this syntax within an async function, Node does not have support for
// top-level await as of Node 12.
const zipFilePath = await download('4.0.4');
import { downloadArtifact } from '@electron/get';
// NB: Use this syntax within an async function, Node does not have support for
// top-level await as of Node 12.
const zipFilePath = await downloadArtifact({
version: '4.0.4',
platform: 'darwin',
artifactName: 'electron',
artifactSuffix: 'symbols',
arch: 'x64',
});
To specify another location to download Electron assets from, the following options are available:
mirrorOptions Object
mirror String (optional) - The base URL of the mirror to download from.nightlyMirror String (optional) - The Electron nightly-specific mirror URL.customDir String (optional) - The name of the directory to download from, often scoped by version number.customFilename String (optional) - The name of the asset to download.resolveAssetURL Function (optional) - A function allowing customization of the url used to download the asset.Anatomy of a download URL, in terms of mirrorOptions:
https://github.com/electron/electron/releases/download/v4.0.4/electron-v4.0.4-linux-x64.zip
| | | |
------------------------------------------------------- -----------------------------
| |
mirror / nightlyMirror | | customFilename
------
||
customDir
Example:
import { download } from '@electron/get';
const zipFilePath = await download('4.0.4', {
mirrorOptions: {
mirror: 'https://mirror.example.com/electron/',
customDir: 'custom',
customFilename: 'unofficial-electron-linux.zip'
}
});
// Will download from https://mirror.example.com/electron/custom/unofficial-electron-linux.zip
const nightlyZipFilePath = await download('8.0.0-nightly.20190901', {
mirrorOptions: {
nightlyMirror: 'https://nightly.example.com/',
customDir: 'nightlies',
customFilename: 'nightly-linux.zip'
}
});
// Will download from https://nightly.example.com/nightlies/nightly-linux.zip
customDir can have the placeholder {{ version }}, which will be replaced by the version
specified (without the leading v). For example:
const zipFilePath = await download('4.0.4', {
mirrorOptions: {
mirror: 'https://mirror.example.com/electron/',
customDir: 'version-{{ version }}',
platform: 'linux',
arch: 'x64'
}
});
// Will download from https://mirror.example.com/electron/version-4.0.4/electron-v4.0.4-linux-x64.zip
Mirror options can also be specified via the following environment variables:
ELECTRON_CUSTOM_DIR - Specifies the custom directory to download from.ELECTRON_CUSTOM_FILENAME - Specifies the custom file name to download.ELECTRON_MIRROR - Specifies the URL of the server to download from if the version is not a nightly version.ELECTRON_NIGHTLY_MIRROR - Specifies the URL of the server to download from if the version is a nightly version.The version downloaded can be overriden by setting the ELECTRON_CUSTOM_VERSION environment variable.
Setting this environment variable will override the version passed in to download or downloadArtifact.
This module downloads Electron to a known place on your system and caches it so that future requests for that asset can be returned instantly. The cache locations are:
$XDG_CACHE_HOME or ~/.cache/electron/~/Library/Caches/electron/%LOCALAPPDATA%/electron/Cache or ~/AppData/Local/electron/Cache/By default, the module uses the built-in Fetch API
as the downloader. As a result, you can pass RequestInit
options via downloadOptions.
By default, a progress bar is shown when downloading an artifact for more than 30 seconds. To
disable, set the ELECTRON_GET_NO_PROGRESS environment variable to any non-empty value, or set
quiet to true in downloadOptions. If you need to monitor progress yourself via the API, set
getProgressCallback in downloadOptions, which receives a Progress object with transferred,
total, and percent properties.
Downstream packages should utilize the initializeProxy function to add HTTP(S) proxy support. If
the environment variable ELECTRON_GET_USE_PROXY is set, it is called automatically.
debug is used to display logs and messages.
Set the DEBUG=@electron/get* environment variable to log additional
debug information from this module.
electron-download is another package that helps in downloading Electron binaries. It is often used internally by other Electron-related tools. Compared to @electron/get, it offers similar functionalities but may not be as straightforward to use for some specific tasks.
electron-builder is a complete solution to package and build Electron applications. While its primary focus is on building and packaging, it also includes functionality to download Electron binaries. It is more feature-rich compared to @electron/get but may be overkill if you only need to download Electron binaries.
electron-prebuilt-compile is a package that provides prebuilt Electron binaries with support for custom compilation. It is useful for developers who need to compile Electron with specific settings. Compared to @electron/get, it offers more flexibility but requires more setup.
FAQs
Utility for downloading artifacts from different versions of Electron
The npm package @electron/get receives a total of 3,850,280 weekly downloads. As such, @electron/get popularity was classified as popular.
We found that @electron/get demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.