
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Graph generator of entire npm registry. See actual visualization here: NPM Universe
Use mouse wheel to zoom in/zoom out.
downloadGraph.sh
file. If you don't have wget simply save response to byField
file. I do not list url directly here, since response is huge (~122MB).node convertToGraph.js byField > graph.out
node layout.js graph.out
. This will take you a while. Layouter saves each 60th iteration into a .pos
file. NOTE Quad tree has a bug which makes it stuck in infinite loop. See referenced issue for a temporary workaround.node flatten.js byField 100.pos > graph.js
Now graph.js
contains information about graph nodes/positions. Each element in the array represents a node:
{"id":"pkgName","pos":{"x":-63,"y":681},"a":"Author","d":[dependency1, dependency2, ...]}
The format is targeted to miminize file size. It could be made even smaller via binary adjacency list. For now I keep it human readable.
MIT
FAQs
Graph generator for entier npm registry
The npm package allnpm receives a total of 0 weekly downloads. As such, allnpm popularity was classified as not popular.
We found that allnpm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.