
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
check-update-package
Advanced tools
This is a very minimal approach to update checking for globally installed packages.
Because it's so simple, the error surface is very tiny and your user's are guaranteed to receive the update message if there's a new version.
You can read more about the reasoning behind this project here.
Firstly, install the package with yarn...
yarn add update-check
...or npm:
npm install update-check
Next, initialize it.
If there's a new update available, the package will return the content of latest version's package.json file:
const pkg = require('./package');
const checkForUpdate = require('update-check');
let update = null;
try {
update = await checkForUpdate(pkg);
} catch (err) {
console.error(`Failed to check for updates: ${err}`);
}
if (update) {
console.log(`The latest version is ${update.latest}. Please update!`);
}
That's it! You're done.
If you want, you can also pass options to customize the package's behavior:
const pkg = require('./package');
const checkForUpdate = require('update-check');
let update = null;
try {
update = await checkForUpdate(pkg, {
interval: 3600000, // For how long to cache latest version (default: 1 day)
distTag: 'canary' // A npm distribution tag for comparision (default: 'latest')
});
} catch (err) {
console.error(`Failed to check for updates: ${err}`);
}
if (update) {
console.log(`The latest version is ${update.latest}. Please update!`);
}
npm linknpm link update-check. Instead of the default one from npm, node will now use your clone.Leo Lamprecht (@notquiteleo) - ZEIT
FAQs
Minimalistic update notifications for command line interfaces
We found that check-update-package demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.