
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
Delete files and directories
Useful for use in build scripts and automated things.
Note that this does permanent deletion. See trash-cli for something safer.
npm install --global del-cli
$ del --help
Usage
$ del <path|glob> …
Options
--force, -f Allow deleting the current working directory and outside
--dry-run, -d List what would be deleted instead of deleting (silent if no matches)
--verbose, -v Display the absolute path of files and directories as they are deleted
Examples
$ del unicorn.png rainbow.png
$ del "*.png" "!unicorn.png"
:warning: Windows users: Since
$ delis already a builtin command on Windows, you need to use$ del-clithere.
Benefits over rimraf CLI: Supports globbing (even on Windows), safer by default as it doesn't allow deleting parent directories, and has a dry-run mode.
Benefits over rm -rf: Cross-platform, safer by default as it doesn't allow deleting parent directories, and has a dry-run mode.
Rimraf is a deep deletion module for node (like `rm -rf`). It is more focused on being a programmatic solution rather than a CLI tool, but it can be used from the command line as well. Rimraf is very robust and handles edge cases like long paths on Windows.
Trash-cli is a command-line tool that moves files and directories to the trash instead of permanently deleting them. This can be safer as it allows for recovery of accidentally deleted files. It is a good alternative if you want a safer deletion process.
Shx is a wrapper around ShellJS Unix commands, providing cross-platform compatibility for shell commands. It includes a `rm` command that can be used to delete files and directories. Shx is useful if you need a broader set of shell commands in addition to deletion.
FAQs
Delete files and directories - Cross-platform
The npm package del-cli receives a total of 350,628 weekly downloads. As such, del-cli popularity was classified as popular.
We found that del-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.