
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@gulujs/readdirp
Advanced tools
Recursive version of fs.readdir. Exposes a stream API and a promise API.
npm install @gulujs/readdirp
import { readdirp } from '@gulujs/readdirp';
// Use streams to achieve small RAM & CPU footprint.
// 1) Streams example with for-await.
for await (const entry of readdirp('.')) {
const { path } = entry;
console.log(`${JSON.stringify({ path })}`);
}
// 2) Streams example, non for-await.
// Print out all JS files along with their size within the current folder & subfolders.
readdirp('.', { fileFilter: '*.js', alwaysStat: true })
.on('data', (entry) => {
const { path, stats: { size } } = entry;
console.log(`${JSON.stringify({ path, size })}`);
})
// Optionally call stream.destroy() in `warn()` in order to abort and cause 'close' to be emitted
.on('warn', error => console.error('non-fatal error', error))
.on('error', error => console.error('fatal error', error))
.on('end', () => console.log('done'));
// 3) Promise example. More RAM and CPU than streams / for-await.
const files = await readdirp('.');
console.log(files.map(file => file.path));
For more examples, check out examples directory.
{
root: '.',
fileFilter: () => true,
directoryFilter: () => true,
filterEntryKey: 'basename',
type: FILE_TYPE,
lstat: false,
depth: 0x80000000,
alwaysStat: false,
suppressNormalFlowError: true
}
rootPath in which to start reading and recursing into subdirectories.
fileFilterFilter to include or exclude files. A Function, Glob string or Array of glob strings.
*.js) which is matched using picomatch,
so go there for more information.
Globstars (**) are also supported, but it is recommended to set filterEntryKey to 'path' or 'fullPath'.
Negated globs (as explained in the minimatch documentation) are allowed, e.g., !*.txt matches everything but text files.['*.json', '*.js'] includes all JavaScript and Json files.
['!.git', '!node_modules'] includes all directories except the '.git' and 'node_modules'.directoryFilterFilter to include/exclude directories found and to recurse into. Directories that do not pass a filter will not be recursed into.
filterEntryKeyWhen fileFilter and directoryFilter is glob string,
use which entry value ('basename' or 'path' or 'fullPath') to test.
Default is 'basename'.
'basename' is the last portion of a 'path'.'path' is a relative path based on root.
'fullPath' is an absolute path.typeDetermines if data events on the stream should be emitted for 'files' (default), 'directories', 'files_directories', or 'all'.
Setting to 'all' will also include entries for other types of file descriptors like character devices, unix sockets and named pipes.
lstatInclude symlink entries in the stream along with files. When true, fs.lstat would be used instead of fs.stat
depthDepth at which to stop recursing even if more subdirectories are found
alwaysStatAlways return stats property for every file.
Default is false, readdirp will return Dirent entries.
Setting it to true can double readdir execution time - use it only when you need file size, mtime etc.
suppressNormalFlowErrorNormal flow error includes 'ENOENT', 'EPERM', 'EACCES', 'ELOOP', 'READDIRP_RECURSIVE_ERROR', will emit as 'warn' event.
Default is true
Setting it to false will emit these error as 'error' event
Forked from paulmillr/readdirp.
FAQs
Recursive version of fs.readdir with streaming API.
We found that @gulujs/readdirp demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.