
Security News
Socket Releases Free Certified Patches for Critical vm2 Sandbox Escape
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.
A command line argument parser without pirates
Input:
node app jump sideways --foo --bar=whee --super-cool=totally
Response:
{
_: [ "jump", "sideways"],
foo: true,
bar: "whee",
"super-cool": "totally"
}
Notice that parameters without --, if any, go into the _ array. Parameters with -- become properties in their own right.
const argv = require('boring')({});
The options object is optional.
It is a common convention to never treat any arguments that appear after a -- placeholder (by itself) as named options, even if they start with --.
Instead, the remainder are treated as positional arguments, no matter what.
To get this behavior with Boring, pass the end: true option:
const argv = require('boring')({
end: true
});
console.log(argv);
Now, when you run this command:
node app hello --pretty -- --boring
You will get:
{
_: [ 'hello', '--boring' ],
pretty: true
}
There is no support for old-fashioned "single-hyphen" options, like:
-x 50
Or:
-h
You can't tell which are boolean and which take arguments unless a specification is passed in. And that's not boring enough for us.
These are very simple to implement, and if you're like us, you'd rather do it yourself.
We have nothing against full-featured, pirate-themed option parsers, which are very nice if you're into that sort of thing. We just find ourselves walking the plank when our options don't follow the pattern of what's easy to validate with piracy.
This simple module is too dumb to break.
Boring was created for use in ApostropheCMS, an open-source content management system built on node.js. If you like Boring you should definitely check out apostrophecms.org.
Feel free to open issues on github.
FAQs
A minimalist command line option parser.
The npm package boring receives a total of 2,048 weekly downloads. As such, boring popularity was classified as popular.
We found that boring demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 15 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.

Research
Five malicious NuGet packages impersonate Chinese .NET libraries to deploy a stealer targeting browser credentials, crypto wallets, SSH keys, and local files.

Security News
pnpm 11 turns on a 1-day Minimum Release Age and blocks exotic subdeps by default, adding safeguards against fast-moving supply chain attacks.