Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Checks if a newer version is available for command line interfaces.
It is designed to be extremely easy to use and for CLI's that want to be in control.
What check-kit
does:
What check-kit
does not do:
npm install check-kit --save
Basic usage:
import check from 'check-kit';
(async () => {
const { current, distTag, name, latest, updateAvailable } = await check();
console.log(`Current version of package ${name} is ${current}`);
if (updateAvailable) {
console.log(`There is a new version available! ${current} -> ${latest}`);
} else {
console.log(`Version ${current} is the latest`);
}
})();
If you know where the package.json
is, you can pass it in:
const result = await check({
pkg: require('./package.json')
});
By default, check-kit
will store update metadata in /tmp/check-kit
directory. You can override
the directory, but not the metadata filename, by passing in the metadata directory:
const result = await check({
metaDir: `${os.homedir()}/myapp/update`
});
async check(opts)
Checks if the specified package has a newer version available.
opts
and all options are optional.
Option | Type | Default | Description |
---|---|---|---|
opts.applyOwner | Boolean | true | When true , determines the owner of the closest existing parent directory and apply the owner to the file and any newly created directories. |
opts.caFile | String | A path to a PEM-formatted certificate authority bundle. | |
opts.certFile | String | A path to a client cert file used for authentication. | |
opts.checkInterval | Number | 3600000 | The amount of time in milliseconds before checking for an update. Defaults to 1 hour. |
opts.cwd | String | "." | The current working directory used to locate the package.json if opts.pkg is not specified. |
opts.distTag | String | "latest" | The tag to check for the latest version. |
opts.force | Boolean | false | Forces an update check. |
opts.keyFile | String | A path to a private key file used for authentication. | |
opts.metaDir | String | "/tmp/check-kit/" | The directory to store package update information. The filename is derived by the package name and the dist tag. |
opts.pkg | Object | String | The parsed package.json , path to the package.json file, or falsey and it will scan parent directories looking for a package.json . | |
opts.proxy | String | A proxy server URL. Can be http or https . | |
opts.registryUrl | String | The npm registry URL. By default, it will autodetect the URL based on the package name/scope. | |
opts.strictSSL | Boolean | true | When falsey, disables TLS/SSL certificate validation for both https requests and https proxy servers. |
opts.timeout | Number | 1000 | The number of milliseconds to wait to query npm before timing out. |
Returns a Promise
that resolves the following:
Property | Type | Description |
---|---|---|
current | String | The current version from the package.json . |
distTag | String | The dist tag used to check the version. |
lastCheck | Number | The timestamp the last check occurred. |
latest | String | null | The latest version returned from the registry or null if the package is not found. |
name | String | The package name. |
updateAvailable | Boolean | Value is true if a new version is available. |
The metadata file contains information about the package and whether an update is available based on the last check.
You can override the directory where the metadata file is stored, but you cannot override the
metadata filename. The filename is derived from the package name and the distribution tag. For
example, the package @foo/bar
would resolve the filename @foo-bar-latest.json
.
check-kit | update-notifier | update-check | |
---|---|---|---|
Version | 1.7.1 | 5.1.0 | 1.5.4 |
Default check interval | 1 hour | 24 hours | 1 hour |
Update check method | Async/await | Subprocess | Async/await |
Notify of updates immediately | :white_check_mark: | :x: | :white_check_mark: |
Persist update available | :white_check_mark: | :white_check_mark: | :white_check_mark: |
User-defined persistance directory | :white_check_mark: | :x: | :x: |
Specify dist tag | :white_check_mark: | :white_check_mark: | :white_check_mark: |
Specify package.json as object | :white_check_mark: | :white_check_mark: | :white_check_mark: |
Specify package.json as path | :white_check_mark: | :x: | :x: |
Automatically find package.json | :white_check_mark: | :x: | :x: |
HTTP proxy support | :white_check_mark: | :x: | :x: |
Force check for updates | :white_check_mark: | :x: | :x: |
Automatic registry URL discovery | :white_check_mark: | :white_check_mark: | :white_check_mark: |
Custom registry URL | :white_check_mark: | :x: | :x: |
Registry auth token support | :white_check_mark: | :white_check_mark: | :white_check_mark: |
Continuous integration check skip | :white_check_mark: | :white_check_mark: | :x: |
NODE_ENV=test check skip | :white_check_mark: | :white_check_mark: | :x: |
NO_UPDATE_NOTIFIER=1 check skip | :white_check_mark: | :white_check_mark: | :x: |
Graceful offline support | :white_check_mark: | :white_check_mark: | :x: |
Apply correct owner when sudo | :white_check_mark: | :x: | :x: |
Type of semver update label | :x: | :white_check_mark: | :x: |
Renders update available message | :x: | :white_check_mark: | :x: |
Persisted opt-out setting | :x: | :white_check_mark: | :x: |
License | Apache 2 | BSD 2-clause | MIT |
This project is open source under the Apache Public License v2 and is developed by
Axway, Inc and the community. Please read the LICENSE
file included
in this distribution for more information.
FAQs
Checks if a newer version is available for command line interfaces
The npm package check-kit receives a total of 3,864 weekly downloads. As such, check-kit popularity was classified as popular.
We found that check-kit demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.