
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
Download and extract files
See download-cli for the command-line version.
$ npm install download
const fs = require('fs');
const download = require('download');
(async () => {
await download('http://unicorn.com/foo.jpg', 'dist');
fs.writeFileSync('dist/foo.jpg', await download('http://unicorn.com/foo.jpg'));
download('unicorn.com/foo.jpg').pipe(fs.createWriteStream('dist/foo.jpg'));
await Promise.all([
'unicorn.com/foo.jpg',
'cats.com/dancing.gif'
].map(url => download(url, 'dist')));
})();
To work with proxies, read the got documentation.
Returns both a Promise<Buffer> and a Duplex stream with additional events.
Type: string
URL to download.
Type: string
Path to where your file will be written.
Type: Object
Same options as got and decompress in addition to the ones below.
Type: boolean
Default: false
If set to true, try extracting the file using decompress.
Type: string
Name of the saved file.
Axios is a promise-based HTTP client for the browser and Node.js. It provides more general HTTP request capabilities compared to 'download' and is often used for API interactions rather than file downloads.
Got is a human-friendly and powerful HTTP request library for Node.js. Similar to 'download', it supports streaming but offers a more extensive set of HTTP capabilities, making it suitable for a wider range of HTTP requests.
Request is a simplified HTTP request client for Node.js. Although it has been deprecated, it was once a popular choice for making HTTP requests and supports file downloads, but with less abstraction compared to 'download'.
Node-fetch is a light-weight module that brings the Fetch API to Node.js. It is similar to 'download' in that it can be used to download files, but it is designed to closely mimic the browser fetch API.
FAQs
Download and extract files
The npm package download receives a total of 760,917 weekly downloads. As such, download popularity was classified as popular.
We found that download demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.