
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
commander-pkg-meta
Advanced tools
A lightweight and robust utility to extract and validate essential metadata from `package.json` properties.
A lightweight and robust utility to extract and validate essential metadata from package.json properties.
This package provides a simple function, getMetaData, to reliably extract a package's name, version, and description. It intelligently determines the package name from either the bin or name field in your package.json and ensures the version is a valid semantic version. It provides sensible defaults and console warnings for invalid inputs, making it a dependable tool for CLI applications and build scripts.
package.json bin or name fields. It prioritizes the bin field:
bin is a string, its trimmed value is used.bin is an object, the trimmed value of its first key is used.bin is not available or usable, it falls back to the name field.semver to validate and clean version strings.semver, this utility is lightweight and dependency-free.npm install commander-pkg-meta
Simply import the getMetaData function and pass it an object containing properties from your package.json.
const { getMetaData } = require('commander-pkg-meta');
const pkg = require('./package.json');
const metadata = getMetaData({
name: pkg.name,
bin: pkg.bin,
version: pkg.version,
description: pkg.description,
});
console.log(metadata);
// Example Output:
// {
// name: 'my-cli-tool',
// version: '1.2.3',
// description: 'A cool command-line tool.'
// }
const { getMetaData } = require('commander-pkg-meta');
const { Command } = require('commander');
try {
const pkg = require('./package.json');
const metaData = getMetaData(pkg);
// program's name, version, and description match those in package.json
const program = new Command();
program.name(metaData.name).version(metaData.version).description(metadata.description);
// ...
} catch (error) {
console.error(error);
}
getMetaData(props)Extracts and validates metadata from package.json properties.
Parameters:
props (Object): An object containing properties, typically from a package.json file.
props.name (string, optional): The package name.props.bin (string | object, optional): The bin field. The name is often derived from this for CLI tools.props.version (string, optional): The package version string.props.description (string, optional): The package description.Returns:
name (string): The resolved package name.version (string): The cleaned semantic version.description (string): The package description.Contributions are welcome! Please read our contributing guidelines to get started.
This project is licensed under the MIT License. See the LICENSE file for details.
FAQs
A lightweight and robust utility to extract and validate essential metadata from `package.json` properties.
We found that commander-pkg-meta demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.