Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
@yarnpkg/libzip
Advanced tools
@yarnpkg/libzip is a library that provides functionalities for working with ZIP archives. It is part of the Yarn package manager's ecosystem and allows for creating, reading, and manipulating ZIP files programmatically.
Creating a ZIP Archive
This code demonstrates how to create a ZIP archive and add a file to it using @yarnpkg/libzip. The `makeInterface` function initializes the libzip interface, and `ZipFS` is used to create and manipulate the ZIP file.
const { makeInterface } = require('@yarnpkg/libzip');
const { ZipFS } = require('@yarnpkg/fslib');
(async () => {
const libzip = await makeInterface();
const zipFs = new ZipFS(null, { libzip });
zipFs.writeFileSync('/file.txt', 'Hello, world!');
zipFs.saveAndClose();
})();
Reading a ZIP Archive
This code demonstrates how to read a ZIP archive and extract a file's content using @yarnpkg/libzip. The ZIP file is read from the filesystem, and `ZipFS` is used to access and read the file within the archive.
const { makeInterface } = require('@yarnpkg/libzip');
const { ZipFS } = require('@yarnpkg/fslib');
const fs = require('fs');
(async () => {
const libzip = await makeInterface();
const zipData = fs.readFileSync('archive.zip');
const zipFs = new ZipFS(zipData, { libzip });
const content = zipFs.readFileSync('/file.txt', 'utf8');
console.log(content); // Outputs: Hello, world!
})();
Listing Files in a ZIP Archive
This code demonstrates how to list all files in a ZIP archive using @yarnpkg/libzip. The ZIP file is read from the filesystem, and `ZipFS` is used to list the files within the archive.
const { makeInterface } = require('@yarnpkg/libzip');
const { ZipFS } = require('@yarnpkg/fslib');
const fs = require('fs');
(async () => {
const libzip = await makeInterface();
const zipData = fs.readFileSync('archive.zip');
const zipFs = new ZipFS(zipData, { libzip });
const files = zipFs.readdirSync('/');
console.log(files); // Outputs: ['file.txt']
})();
ADM-ZIP is a pure JavaScript implementation for ZIP file handling. It provides similar functionalities to @yarnpkg/libzip, such as creating, reading, and extracting ZIP files. ADM-ZIP is widely used and has a straightforward API, making it a good alternative for ZIP file manipulation.
JSZip is a library for creating, reading, and editing .zip files with a JavaScript API. It is highly popular and well-documented, offering a range of features similar to @yarnpkg/libzip. JSZip is known for its ease of use and compatibility with both Node.js and browser environments.
node-stream-zip is a library for working with ZIP archives in a streaming manner. It allows for efficient reading and extraction of large ZIP files without loading the entire archive into memory. This makes it a good choice for handling large ZIP files compared to @yarnpkg/libzip.
@yarnpkg/libzip
This package contains a wasm-compiled version of the libzip.
artifacts/build.sh
artifacts/build.sh
scriptartifacts/exported.json
sources/index.ts
artifacts/build.sh
script3.1.0
yarn workspaces list
and yarn workspaces foreach
commands now both support a new --since
option that lets you filter the workspace list by changes (only workspaces that changed since the specified commit will be iterated on). This feature is still a little experimental, especially when used with -R,--recursive
.yarn workspaces foreach
command now handles the fact that a script containing :
only becomes global if it exists in exactly one workspace.yarn workspaces foreach
command now supports --jobs 1
and --jobs unlimited
.yarn init -2
command will now add the packageManager
field to your project manifest.pattern
matcher from logFilters
will now match any part of the log entry.nodeLinker: pnpm
mode will let you install packages using the pnpm install strategy, where packages are stored flat and referenced by each others through symlinks. This mode is still a little experimental, so please send our way bugs you might find.supportedArchitectures
field to manually enforce the presence of specific architectures.nmMode: hardlinks-global
setting will now be automatically downgraded to nmMode: hardlinks-local
when global caches and install folders are kept on different devices, thus letting the install continue normally. A warning will still be produced explaining this behaviour.node_modules
linker maximizes chances to end-up with only one top-level node_modules in the case of using workspacesnmSelfReferences
setting has been added to the nm linker to control whether workspaces are allowed to require themselves - results in creation of self-referencing symlinks. yarn workspaces focus
will not create self-referencing symlinks for excluded workspaces anymore.node_modules
installs.workspace:^
and workspace:~
. When published, those markers will turn into the actual version (just like what used to happen with workspace:*
), except that they'll be prefixed with the relevant semver prefix (respectively ^
and ~
).npmAuditRegistry
setting will let you define which registry to use when running audits. If unset, we'll fallback to the currently configured publish registry (we'll likely change this behavior in Yarn 4 to rather use the fetch registry).node_modules
installs will now be given priority during hoisting, preventing cases when indirect regular dependencies would block the way for direct portal dependencies.pnpify
binary can now be used from inside directories containing spaces.--version
string.node-modules
linker.node-modules
linker, since they cannot be used from the code anyway.fs
module, allowing users to patch it.require.resolve('pnpapi')
will be handled correctly even when using exports
.yarn run
immediately after adding or removing dependencies inside large monorepos.@types
version. This matches the behaviour for peer dependencies.pnpEnableEsmLoader
.resolve
will no longer resolve missing modules to a file with the same name that would happen to be located next to the issuer.FAQs
Unknown package
The npm package @yarnpkg/libzip receives a total of 2,020,735 weekly downloads. As such, @yarnpkg/libzip popularity was classified as popular.
We found that @yarnpkg/libzip demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.