
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
assert-version
Advanced tools
Check if version mentions match the one from package.json
npm install -g assert-version
Version could be extracted with regular expression or, if you use
assert-version
as Node.js module, with user-defined function.
In case of regular expression, version should present in first capture.
There are two default regular expressions. If your file has .json
extension,
/"version":\s*"([^"]+)/
expression is used. Otherwise,
/\/\*\![\s\S]+(v?\d+\.\d+\.\d+)/
expression is used. I understand that these
expressions are not great, they just seem to work for my cases. Feel free to
send improvements.
Extracted version should be valid semver version.
assertVersion = require('assert-version');
var error = assertVersion({
'bower.json': '', // First default regular expression will be used.
'mylib.js': '', // Second default regular expression will be used.
'other.js': /version=([^,]+)/,
'other2.js': function(contents) {
// `contents` is a file contents, function should return version as
// string.
return contents.substring(100500, 100510);
},
'other3.js': [matcher1, matcher2] // If you need to check more than one place in file.
});
// `error` will have error message in case of error, `undefined` otherwise.
Optionally, you can pass path to package.json
with reference version as
second argument of assertVersion()
. It is package.json
from current
working directory by default.
Same to previous example (except for function extractor):
assert-version -f bower.json -f mylib.js -f other.js='version=([^,]+)' -f other3.js=matcher1 -f other3.js=matcher2
Example from https://github.com/hoho/conkitty-route/blob/master/gulpfile.js.
gulp.task('assert-version', function(err) {
var assertVersion = require('assert-version');
err(assertVersion({
'croute.js': '',
'bower.json': ''
}));
});
Example from https://github.com/hoho/concat.js/blob/master/Gruntfile.js.
grunt.registerTask('assert-version', function() {
var assertVersion = require('assert-version'),
error;
error = assertVersion({
'concat.js': '',
'bower.json': ''
});
if (error) {
grunt.log.error(error);
return false;
}
});
FAQs
Check if version mentions match the one from package.json
The npm package assert-version receives a total of 0 weekly downloads. As such, assert-version popularity was classified as not popular.
We found that assert-version demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.