
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
@herdwatch/check-engine
Advanced tools
A utility to check your package.json engines in Node.js projects. Inspired by the Thali Project in validateBuildEnvironment.js
For projects of all sizes, but especially for mid to large size teams, environments get out of sync. Even slight variations in these build / development environments can kill productivity.
Validates your system to make sure you have the correct system tools and dependencies installed. Uses the engine object from a package.json
located in the current or specified directory to determine what system dependencies
or installed tools validate.
Currently Supporting:
Dependencies | Semantic Versioning |
---|---|
OS X (MacOS) | |
Node.js | :white_check_mark: |
npm | :white_check_mark: |
jx (JXCore) | |
cordova | |
appium | |
ios-deploy | |
ios-sim | |
bower | :white_check_mark: |
ios-webkit-debug-proxy | |
ideviceinstaller | |
java | |
ant | |
git | |
gulp-cli | |
cocoapods | |
xcodebuild | |
carthage | |
xcpretty | |
libimobiledevice | |
deviceconsole | |
check-engine | |
yarn | :white_check_mark: |
nsp | |
pnpm | :white_check_mark: |
See the validatorRules.js file file for the full list of things that are supported.
Some dependencies support engines with Semantic Versioning.
check-engine can be installed globally or in a local directory.
npm install -g check-engine
npm install check-engine
Simply run:
check-engine [path_to_package.json] [options]
Where:
path_to_package.json
is an optional path to a package.json
file containing a list of engines
to validate. If omitted, a package.json file will be looked
for in the current working directory.and [options]:
--ignore
: Ignore package validation errors and do not return an error exit code. Parsing issues or
fatal errors will still return a error code.--help
: Display command line options--version
: Display versionNote: If check-engine is installed locally and you are not running it
as part of an npm script, you will
have to specify the path to the check-engine executable, which will be
./node_modules/.bin/check-engine
. Specifying this path is not necessary
within npm scripts, because npm automatically puts the ./node_modules/.bin
folder into the environment's PATH
.
var checkEngine = require('check-engine');
checkEngine('<path to package.json>').then((result) => {
if (result.status !== 0) {
console.log('it failed!');
} else {
console.log('it worked!');
}
}
The resolved object contains higher level status, as well as information for individual packages that were validated. The above example only shows the high level. The object structure for the result object is as follows:
{
status: 0 if successful, -1 otherwise
message: {
text: 'overall error description'
type: 'error' or 'success'
},
packages: [
{
name: 'name of package',
type: 'error', 'success', or 'warn',
validatorFound: true or false,
expectedVersion: 'version listed in package.json for this package', // exists only if validatorFound is true
commandError: 'error result from validator process execution', // exists only if error occurred
foundVersion: 'version number found' // exists only if validatorFound is true and there was no commandError error
}
]
}
For example usage of this, see check-engine.js.
cd check-engine
.npm i -g eslint
.npm run lint
.npm test
.npm version [major, minor, or patch]
.npm publish
.git push --tags
FAQs
A system version checker in Node.js
We found that @herdwatch/check-engine demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.