Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
@lerna/log-packed
Advanced tools
@lerna/log-packed
Log the result of npm pack --json
Extracted from the npm source.
const execa = require('execa');
const logPacked = require('@lerna/log-packed');
execa('npm', ['pack', '--json']).then(result => {
const tarballs = JSON.parse(result.stdout);
tarballs.forEach(logPacked);
});
3.0.0 (2018-08-10)
npm pack
experience (627cfc2)npm pack
before npm publish
(8d80b2c)lerna version
from of lerna publish
(#1522) (8b97394), closes #277 #936 #956 #961 #1056 #1118 #1385 #1483 #1494changed: The package names emitted to stdout are no longer prefixed by a "- ", and private packages are no longer displayed by default.
list: The default output of lerna ls
no longer shows version strings or private packages.
The new alias lerna la
resembles the old output, with the addition of relative path to the package
The new alias lerna ll
is a shortcut for the new --long
option
A new --parseable
option has been added to aid magical piping incantations
--preid
now defaults to "alpha" during prereleases:The previous default for this option was undefined, which led to an awkward "1.0.1-0" result when passed to semver.inc()
.
The new default "alpha" yields a much more useful "1.0.1-alpha.0" result. Any previous prerelease ID will be preserved, just as it was before.
--no-verify
is no longer passed to git commit
by default, but controlled by the new --commit-hooks
option:
The previous behavior was too overzealous, and the new option operates exactly like the corresponding npm version option of the same name.
As long as your pre-commit hooks are properly scoped to ignore changes in package.json files, this change should not affect you. If that is not the case, you may pass --no-commit-hooks
to restore the previous behavior.
<a name="3.0.0-rc.0"></a>
FAQs
Log the result of npm pack --json
The npm package @lerna/log-packed receives a total of 345,910 weekly downloads. As such, @lerna/log-packed popularity was classified as popular.
We found that @lerna/log-packed demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.