
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
convert-registry
Advanced tools
This is a module to convert the registry of your yarn.lock
file.
See Deprecating registry.yarnpkg.com.
Also, you can use this module in CI environment. For example, if you're a Chinese user, you may use 3rd-party npm registry mirror. However, the connection speed between CI and that mirror is very slow, so you can run this module before installing your dependencies to reduce installation time.
You can use this module as Node.js library or in CLI.
Install it locally:
$ yarn add --dev convert-registry
Then, write a script like this:
const fs = require('fs')
const convertRegistry = require('convert-registry')
const lockfile = fs.readFileSync('./yarn.lock', 'utf-8')
convertRegistry(lockfile, 'https://registry.npmjs.org/')
.then(newLockfile => fs.writeFileSync('./yarn.lock', newLockfile))
convertRegistry(content, registry = 'https://registry.npmjs.org/')
content
Type: string
Required: true
This is the yarn.lock
file content, not the path of yarn.lock
file.
registry
Type: string
Default: 'https://registry.npmjs.org/'
The registry URL you want to convert to, and if you omit this parameter, the default value is "https://registry.npmjs.org/".
Type: Promise<string>
It returns a Promise
because this module will do network requests.
It is a Promise
-wrapped string, so the string is the converted lockfile.
That is, you should save it to file manually by some APIs like fs.writeFileSync
.
Install it globally:
$ yarn global add convert-registry
Use:
$ convert-registry https://registry.npmjs.org/
This CLI program receives 1-2 arguments.
The first argument is the registry.
The second argument is the path of lock file.
You can omit it, so it will use yarn.lock
in the current working directory.
MIT Licensed
Copyright © 2018-present Pig Fang
FAQs
Convert the registry of your yarn.lock file.
We found that convert-registry demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.