Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@npmcorp/copy
Advanced tools
Copy files, directories and symlinks
const copy = require('@npminc/copy')
copy('/path/to/thing', '/new/path/thing').then(() => {
// this is now copied
}).catch(err => {
// oh noooo
})
Copies files, directories and symlinks. Ownership is maintained when running as root, permissions are always maintained. On Windows, if symlinks are unavailable then junctions will be used.
Recursively copies from
to to
and resolves its promise when finished.
If to
already exists then the promise will be rejected with an EEXIST
error.
Options are:
1
) The maximum number of concurrent copies to do at once.copy.item
) The function to call on each file after recursing into a directory.process.platform === 'win32'
) If true enables Windows symlink semantics. This requires
an extra stat
to determine if the destination of a symlink is a file or directory. If symlinking a directory
fails then we'll try making a junction instead.Options can also include dependency injection:
global.Promise
) The promise implementation to use, defaults to Node's.require('fs')
) The filesystem module to use. Can be used
to use graceful-fs
or to inject a mock.require('fs-write-stream-atomic')
) The
implementation of writeStreamAtomic
to use. Used to inject a mock.process.getuid
) A function that returns the current UID. Used to inject a mock.Ordinarily you'd only call copy
above. But it's possible to use it's
component functions directly. This is useful if, say, you're writing
@npminc/move.
Copies a ordinary file from
to destination to
. Uses
fs-write-stream-atomic
to ensure that the file is entirely copied or not
at all.
Options are:
getuid()
is 0
then this and gid will be used to
set the user and group of to
. If uid is present then gid must be too.to
will have its perms set to mode
.require('fs')
) The filesystem module to use. Can be used
to use graceful-fs
or to inject a mock.global.Promise
) The promise implementation to use, defaults to Node's.require('fs-write-stream-atomic')
) The
implementation of writeStreamAtomic
to use. Used to inject a mock.Copies a symlink from
to destination to
. If on Windows then if
symlinking fails, a junction will be used instead.
Options are:
require('fs')
) The filesystem module to use. Can be used
to use graceful-fs
or to inject a mock.global.Promise
) The promise implementation to use, defaults to Node's.process.platform === 'win32'
) If true enables Windows symlink semantics. This requires
an extra stat
to determine if the destination of a symlink is a file or directory. If symlinking a directory
fails then we'll try making a junction instead.Reads all of the files in directory from
and adds them to the queue
using recurseWith
(by default copy.item
).
Options are:
run-queue
object to add files found inside from
to.copy.item
) The function to call on each file after recursing into a directory.getuid()
is 0
then this and gid will be used to
set the user and group of to
. If uid is present then gid must be too.to
will have its perms set to mode
.require('fs')
) The filesystem module to use. Can be used
to use graceful-fs
or to inject a mock.process.getuid
) A function that returns the current UID. Used to inject a mock.Copies some kind of from
to destination to
. This looks at the filetype
and calls copy.file
, copy.symlink
or copy.recurse
as appropriate.
Symlink copies are queued with a priority such that they happen after all file and directory copies as you can't create a junction on windows to a file that doesn't exist yet.
Options are:
run-queue
object to
pass to copy.recurse
if from
is a directory.copy.item
) The function to call on each file after recursing into a directory.getuid()
is 0
then this and gid will be used to
set the user and group of to
. If uid is present then gid must be too.to
will have its perms set to mode
.require('fs')
) The filesystem module to use. Can be used
to use graceful-fs
or to inject a mock.process.getuid
) A function that returns the current UID. Used to inject a mock.process.platform === 'win32'
) If true enables Windows symlink semantics. This requires
an extra stat
to determine if the destination of a symlink is a file or directory. If symlinking a directory
fails then we'll try making a junction instead.global.Promise
) The promise implementation to use, defaults to Node's.require('fs-write-stream-atomic')
) The
implementation of writeStreamAtomic
to use. Used to inject a mock.FAQs
Copy files, directories and links, preserving ownership and perms
The npm package @npmcorp/copy receives a total of 0 weekly downloads. As such, @npmcorp/copy popularity was classified as not popular.
We found that @npmcorp/copy demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.