
Security News
OpenClaw Skill Marketplace Emerges as Active Malware Vector
Security researchers report widespread abuse of OpenClaw skills to deliver info-stealing malware, exposing a new supply chain risk as agent ecosystems scale.
@npmcli/agent
Advanced tools
A pair of Agent implementations for nodejs that provide consistent keep-alives, granular timeouts, dns caching, and proxy support.
const { getAgent, HttpAgent } = require('@npmcli/agent')
const fetch = require('minipass-fetch')
const main = async () => {
// if you know what agent you need, you can create one directly
const agent = new HttpAgent(agentOptions)
// or you can use the getAgent helper, it will determine and create an Agent
// instance for you as well as reuse that agent for new requests as appropriate
const agent = getAgent('https://registry.npmjs.org/npm', agentOptions)
// minipass-fetch is just an example, this will work for any http client that
// supports node's Agents
const res = await fetch('https://registry.npmjs.org/npm', { agent })
}
main()
All options supported by the node Agent implementations are supported here, see the docs for those.
Options that have been added by this module include:
family: what tcp family to use, can be 4 for IPv4, 6 for IPv6 or 0 for both.proxy: a URL to a supported proxy, currently supports HTTP CONNECT based http/https proxies as well as socks4 and 5.dns: configuration for the built-in dns cache
ttl: how long (in milliseconds) to keep cached dns entries, defaults to 5 * 60 * 100 (5 minutes)lookup: optional function to override how dns lookups are performed, defaults to require('dns').lookuptimeouts: a set of granular timeouts, all default to 0
connection: time between initiating connection and actually connectingidle: time between data packets (if a top level timeout is provided, it will be copied here)response: time between sending a request and receiving a responsetransfer: time between starting to receive a request and consuming the response fullyThe `useragent` package is a comprehensive library for parsing and generating user agent strings. It provides more detailed parsing capabilities compared to @npmcli/agent, making it suitable for applications that need to analyze user agent strings in depth.
The `ua-parser-js` package is a JavaScript library for parsing user agent strings. It offers extensive support for detecting browser, engine, OS, and device information. Compared to @npmcli/agent, it focuses more on parsing and less on generating user agent strings.
FAQs
the http/https agent used by the npm cli
The npm package @npmcli/agent receives a total of 9,714,309 weekly downloads. As such, @npmcli/agent popularity was classified as popular.
We found that @npmcli/agent demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Security researchers report widespread abuse of OpenClaw skills to deliver info-stealing malware, exposing a new supply chain risk as agent ecosystems scale.

Security News
Claude Opus 4.6 has uncovered more than 500 open source vulnerabilities, raising new considerations for disclosure, triage, and patching at scale.

Research
/Security News
Malicious dYdX client packages were published to npm and PyPI after a maintainer compromise, enabling wallet credential theft and remote code execution.