
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
discoverable
Advanced tools
Discover packages and modules to compose your applications.
Packages declare what types they provide and what modules implement those types in their package.json files.
Applications declare what packages to scan for discoverable modules in their package.json files.
It's a layer of indirection between your code and your dependencies. Use
discover('foo') in your code and configure what specific modules implement
"foo" in your package.json.
npm i -S discoverable
var discover = require('discoverable');
discover('things').then(function(things) {
// use things here
});
// or
discover('things', function(err, things) {
// use things here
});
A package is discoverable if it has something like this in its package.json:
"discoverable": {
"modules": {
"things": "lib/things/*.js",
"otherThings": "lib/other/*-thing.js"
}
}
To be more selective, do this:
"discoverable": {
"modules": {
"things": [
"lib/thing1.js",
"lib/thing2.js"
],
"otherThings": "lib/other/other-thing.js"
}
}
There are no requirements on what modules must export, but they should be polymorphic for any given type.
If the packages you need are public and discoverable, install them with npm and put this in your package.json:
"discoverable": {
"packages": "node_modules/*"
}
If you want to be more selective, do this:
"discoverable": {
"packages": [
"node_modules/foo",
"node_modules/bar"
]
}
If the packages you want to discover aren't discoverable (or not even proper packages), do this:
"discoverable": {
"packages": {
"lib/*": {
"modules": {
"things": "lib/things/*.js"
}
}
}
}
You can be as selective as you want.
The default export is a function:
var discover = require('discoverable');
Discovers and requires modules of the given type.
Arguments:
type - Stringcallback - function(err, modules) (optional)Returns:
Promise for Array of the modules' exportsDiscovers modules of a given type without require'ing them.
Arguments:
type - Stringcallback - function(err, modules) (optional)Returns:
Promise for Array of modules objects that look like this:{
type: 'type',
package: 'name', // from "name" in package.json or directory name
filename: '/path/to/module.js',
name: 'module', // from filename
exports: null, // might be defined if previously required
require: function() {
// requires the module, later returns cached exports
}
}
FAQs
discover packages and modules to compose your applications
We found that discoverable demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.