
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@foxxmd/get-version
Advanced tools
A convenient way to get a version identifier from a set of ordered sources (ENV, Git, File, NPM Package, default value...)
Features:
version in NPM Packages
package.jsonpackage-lock.jsonnpm-shrinkwrap.jsonDocumentation best viewed on https://foxxmd.github.io/get-version
You have a project that can be distributed, or run, in multiple ways. You want to output the version of the project so users know what they are running or for debugging purposes.
The problem you have is you have:
and there's no one way to make sure all of these instances display an accurate version unless you want to manually add/commit a Source of Truth value somewhere every time you make a change.
@foxxmd/get-version solves this problem. By using multiple sources, in an order you define, to glean a "version identifier" you can programmatically determine the most accurate identifier to display.
We will look for a version from sources in this order=: ENV, Git, NPM, Fallback
First look for ENV...
APP_VERSION parsed from release tag with GH ActionsAPP_VERSION for one-offsENV not found then with Git...
{branch}-{commit}Git not found then with NPM...
package-lock.json in project folder and uses version set by you for releaseNPM not found...
fallback value set in project so you know user is using an uncommon setup (or something is wrong!)npm install @foxxmd/get-version
import { getVersion } from "@foxxmd/get-version";
// defaults to ENV => Git => Files => NPM => Fallback
const version = await getVersion();
console.log(version); // 1.0.0
Pass an object implementing VersionOpts to getVersion
import { getVersion, VersionOpts } from "@foxxmd/get-version";
import path from 'node:path';
const opts: VersionOpts = {
priority: ['file', 'env', 'git'],
env: {
names: ['CUSTOM_VERSION','APP_VERSION']
},
file: {
npmPackage: false,
additionalFiles: [path.join(process.cwd(), 'version.txt')],
},
git: {
gitTemplate: 'GIT-{branch}-{hash}'
},
fallback: 'unknown'
}
const version = await getVersion(opts);
console.log(version); // 1.0.0
FAQs
Get a version identifier from multiple sources
We found that @foxxmd/get-version demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.