
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
folder-hash is a cli tool that generates a hash for a folder, based on the files in it.
@puya/fh is a tool that creates a hash for a directory based on the sub-directories/files located in it.
As developers we all remember the troubles of building/transfering files from a published folder in a dev machine to a folder in a production server.
No matter how sharp we track the files we change during developement so that only copy them to production server not the whole published folder, we are all ended up creating a zip file, transfer it to production server, extract it there in the root of a website and free ourselves.
The slow transfer is painful, but the result is right at target (no errors - God willing -, all old files are replaced by their new updated version).
The issue resolved, but we always asked ourselves at the end of the day, couldn't be there a tool by which we could copy/transfer only the changed files, not the whole publish folder?
@puya/fh was created to help answering exactly this need.
@puya/fh has two main features:
json file for a folder based on its content.The generated json for a given directory can be used to ...
With these capabilities at hand, the problem described in Story section can be easily resolved.
We can now transfer only the changed files to the production server.
npm i @puya/fh -g
Base usage:
fh [command] [args] [options]
command:
hash: generates json file for a folder based on its content.diff: checks the differences between two foldersapply: copies the differences between two folders to a target directory.[args] depend on `[command].
[options]:
-ed or --exclude-dirs: specify a comma separated list of excluded folders that should be ignored.-ef or --exclude-files: specify a comma separated list of excluded files that should be ignored.-id or --include-dirs: specify a comma separated list of included folders that should not be ignored.-if or --include-files: specify a comma separated list of excluded files that should not be ignored.-q or -quiet: quiet mode (do not show output messages in console)-ns or --no-sort: do not sort folder/files-dbm or --debug-mode: debug mode-dp or --deep: show deep detailsOther args:
-? or --help: show help-v or --version: show the tool version numberNotes:
include lists have more priority over exclude lists.md5 hash.md5 based on the content of a sub-directory.Using @puya/fh in CLI is described in details a little furthur.
import { FolderUtil } from "@puya/fh";
const json = FolderUtil.getHash(dir);
console.log(json.hash);
Args:
-d or --dir: path of directory for which hash should be generated (could be an absolute or relative path).-o or --output: path/name of generated json file.example 1: create hash for current directory
fh
example 2: create hash for /publish folder in current directory
fh hash -d ./publish
example 3: create hash for /publish folder as hash.json
fh hash -d ./publish -o hash.json
example 4: create hash for /publish folder in current directory, do not sort file/folders
fh hash -d ./publish -ns
example 5: create hash for /publish folder in current directory, quiet mode.
fh hash -d ./publish -q
Args:
-f or --from: (relative/absolute) path of from or source folder (the folder we are comparing to) or (relative/absolute) path of its json.-t or --to: (relative/absolute) path of to or destination folder (the folder we are comparing) or (relative/absolute) path of its json.-rf or --relative-from: a path for from folder that will be used in generated batch or apply command (copying files/folders) for source file/dirs.-rt or --relative-to: a path for to folder that will be used in generated batch or apply command (copying files/folders) for destination file/dirs.-k or --kind: kind of operation to be performed on detected changes.
cmd: generate a windows .bat file to copy changes.bash: generate a linux .sh file to copy changes.report: report or show changes.example 1: compare ./dev to ./prod directories, report changes
fh diff -f ./dev -t ./prod
example 2: compare dev.json to prod.json hash files, report changes
fh diff -f dev.json -t prod.json
example 3: compare ./dev to prod.json, report changes
fh diff -f ./dev -t prod.json
example 4: compare ./dev to ./prod directories, generate cmd batch file
fh diff -f ./dev -t ./prod -k cmd
example 5: compare ./dev to ./prod directories, generate bash file named ch20250512.sh
fh diff -f ./dev -t ./prod -k bash -o ch20250512.sh
example 6: compare ./dev to prod.json, generate cmd batch file named ch20250512.bat relative to ./publish dir
fh diff -f ./dev -t prod.json -rt ./publish -k cmd -o ch20250512.bat
Args:
arguments are the same as those used in diff command.
example 1: compare ./dev to ./prod directories, apply changes from './dev' into './prod'.
fh apply -f ./dev -t ./prod
example 2: compare ./dev to prod.json, copy into -rt
fh apply -f ./dev -t ./prod -rt ./publish
example 3: create zip archive out of changes
fh apply -f ./dev -t ./prod -c
There are a default list of files and folders that @puya/fh ignores them by default.
default excluded folders
Excluded files:
These lists can be customized through cli arguments.
FAQs
folder-hash is a cli tool that generates a hash for a folder, based on the files in it.
We found that @puya/fh demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.