Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
All Your Files Kept Minimal.
Run ayfkm
after npm install
to trim out cruft. Here "cruft" means any
files that aren't required for running your node module dependencies.
Default (hopefully reasonable) cruft patterns are included. Customize
with a ".ayfkm" file in your repo.
Some basic parts working. The docs and current implementation don't yet agree. Come back later please!
npm install -g ayfkm
See below if installing globally isn't your thing.
First, create a ".ayfkm" config file for your project as follows. This will include the default cruft patterns (patterns use glob syntax and are implicitly for paths under "./node_modules").
ayfkm --init
Then you can clean out the cruft with:
ayfkm
Here is an example run (use -v,--verbose
to list every file being removed):
$ ayfkm --init
"/Users/trentm/tm/node-bunyan/.ayfkm" created with default patterns
$ ayfkm
75 files/dirs removed under "/Users/trentm/tm/node-bunyan/node_modules"
3209616 bytes -> 2496922 bytes (22%)
As long as you only want/need the default cruft patterns, then you can clean cruft without a config file with:
ayfkm -f # or `ayfkm --force`
There are a couple reasons -f,--force
or a config file is required:
ayfkm
behaviour is to delete files. That's dangerous and
invasive. Requiring the config file is an "opt-in".ayfkm
globallynpm install -g ...
might not be your thing. However adding a dependency on
ayfkm
when the point is to reduce the size of your deps is ironic. The
answer is
devDependencies
and, optionally, the rm-self
ayfkm pragma.
Put this in your "package.json":
...
"devDependencies": {
"ayfkm": "*"
},
...
and this somewhere in your ".ayfkm":
# +pragma: rm-self
XXX
TODO: Doc the best practice of blank-line-separated and comment-preceded sections.
FAQs
All Your Files Kept Minimal
The npm package ayfkm receives a total of 3 weekly downloads. As such, ayfkm popularity was classified as not popular.
We found that ayfkm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.