
Security News
minimatch Patches 3 High-Severity ReDoS Vulnerabilities
minimatch patched three high-severity ReDoS vulnerabilities that can stall the Node.js event loop, and Socket has released free certified patches.
@vltpkg/cache
Advanced tools
The filesystem cache for @vltpkg/registry-client, but also, a
general-purpose filesystem-backed LRUCache
This is very minimal on features, because it has a very narrow use case, but if you want to have a persistently fs-backed LRU memory cache of Buffers using strings as keys, then this is the thing to use.
import { Cache } from '@vltpkg/cache'
const numberOfItemsToKeepInMemory = 10_000
const cache = new Cache({
path: '/path/to/fs/cache/folder',
// the number of items to keep in memory
// on-disk folder will just keep everything
// see @vltpkg/cache-manager for handling that
max: 10_000,
})
// reading is always async, because it has to go to disk maybe
// this is a wrapper around an LRUCache#fetchMethod that reads
// from the file system
const someCachedValue = await cache.fetch(someKey)
// fetch by integrity, if available:
const integrity =
'sha512-6/mh1E2u2YgEsCHdY0Yx5oW+61gZU+1vXaoiHHrpKeuRNNgFvS+/jrwHiQhB5apAf5oB7UB7E19ol2R2LKH8hQ=='
const valueByInt = await cache.fetch('blah', {
context: { integrity },
})
// synchronous cache read, will only return a value if present in
// the memory cache. Does *not* fall back to the fs store.
const valueFromMemoryCache = cache.get(someKey)
// synchronous cache read, which does fall back to the fs store,
// using synchronous file I/O
const valueUsingSyncFileSystemOps = cache.fetchSync(someKey)
// set operations are atomically written to the fs cache in the
// background but are available immediately because they are
// added to the memory cache first
cache.set('some-key', Buffer.from('some-value'))
// set with integrity creates a hard-linked file at the content
// address, so that anyone fetching the same content by any other
// key will get the same result.
cache.set(someKey, someValue, { integrity })
await cache.promise() // once it's done writing...
// returns identical bits as someValue, because on-disk cache
// hard links to a file based on the integrity value.
const otherValue = await cache.fetch(otherKey, {
context: { integrity },
})
FAQs
The filesystem cache for `@vlt/registry-client`
The npm package @vltpkg/cache receives a total of 25,692 weekly downloads. As such, @vltpkg/cache popularity was classified as popular.
We found that @vltpkg/cache demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
minimatch patched three high-severity ReDoS vulnerabilities that can stall the Node.js event loop, and Socket has released free certified patches.

Research
/Security News
Socket uncovered 26 malicious npm packages tied to North Korea's Contagious Interview campaign, retrieving a live 9-module infostealer and RAT from the adversary's C2.

Research
An impersonated golang.org/x/crypto clone exfiltrates passwords, executes a remote shell stager, and delivers a Rekoobe backdoor on Linux.