
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Have you ever wanted to exec things asyncly? Now you can!
npm install -S async-exec
Then in your code use any of the following patterns:
The default export is intended to be pretty convenient.
import exec from 'async-exec';
Run a single command expressed as a string and return the stdout when complete.
await exec(`osascript -e "set volume ${scaledVolume}"`);
const tsFiles = await exec(`find . -name "*.ts"`);
For tee-style logging, where the output is both sent to stdout as it arrives, and captured in the return value, set the second argument to true
.
exec('ls', true);
These other functions are provided in case they are useful.
In addition to returning the stdout, this function will console.log each line.
Run a command, return the stdout and call a function for each line of output. You could use this to console.log only the lines you want.
Run a command, return stdout and call a function on every 'data' event. This function gives you access to the raw data which you can parse any way you'd like for your situation.
Go ahead and send me PRs. I love them. Especially if they contain tests and don't check in generated files.
Not sure how to fix it yourself? Submit an issue and we'll get it done eventually!
Mostly for my own recollection, publishing goes like this.
<commit changes>
npm version <major|minor|patch>
git push origin master
npm publish
FAQs
Promise based exec
We found that async-exec demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.