Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
The 'download' npm package is a utility that allows you to download files over HTTP or HTTPS. It is a high-level function that abstracts away the complexity of making HTTP requests and handling streams, making it easier to download files.
Downloading files
This feature allows you to download files from a given URL and save them to a specified directory. The function returns a promise that resolves when the download is complete.
const download = require('download');
download('https://example.com/somefile.png', 'dist').then(() => {
console.log('File downloaded!');
});
Downloading and extracting archives
This feature enables the downloading of archive files like ZIP or TAR and automatically extracts them to a specified directory.
const download = require('download');
download('https://example.com/somearchive.zip', 'dist', { extract: true }).then(() => {
console.log('Archive downloaded and extracted!');
});
Downloading files with options
This feature allows you to pass custom options such as headers, query parameters, and more, providing additional control over the HTTP request.
const download = require('download');
const options = {
headers: { 'User-Agent': 'my-custom-agent' }
};
download('https://example.com/somefile.png', 'dist', options).then(() => {
console.log('File downloaded with custom headers!');
});
Axios is a promise-based HTTP client for the browser and Node.js. It provides more general HTTP request capabilities compared to 'download' and is often used for API interactions rather than file downloads.
Got is a human-friendly and powerful HTTP request library for Node.js. Similar to 'download', it supports streaming but offers a more extensive set of HTTP capabilities, making it suitable for a wider range of HTTP requests.
Request is a simplified HTTP request client for Node.js. Although it has been deprecated, it was once a popular choice for making HTTP requests and supports file downloads, but with less abstraction compared to 'download'.
Node-fetch is a light-weight module that brings the Fetch API to Node.js. It is similar to 'download' in that it can be used to download files, but it is designed to closely mimic the browser fetch API.
Download and extract files effortlessly
$ npm install --save download
If you're fetching an archive you can set extract: true
in options and
it'll extract it for you.
var download = require('download');
// download and extract `foo.tar.gz` into `bar/`
download('foo.tar.gz', 'bar', { extract: true });
// download and save `foo.exe` into `bar/foo.exe` with mode `0755`
download('foo.exe', 'bar', { mode: '0755' });
// download and save `foo.zip` into `bar/foobar.zip`
download({ url: 'foo.zip', name: 'foobar.zip' }, 'bar');
// download and save an array of files in `bar/`
var files = ['foo.jpg', 'bar.jpg', 'cat.jpg'];
download(files, 'bar');
// download, save and rename an array of files in `bar/`
var files = [{
url: 'foo.jpg',
name: 'foobar.jpg'
}, {
url: 'cat.jpg',
name: 'dog.jpg'
}];
download(files, 'bar');
Download a file or an array of files to a given destination. Returns an EventEmitter that emits the following possible events:
response
— Relayed when the underlying http.ClientRequest
emits the same
event. Listeners called with a http.IncomingMessage
instance.data
— Relayed when the underlying http.IncomingMessage
emits the same
event. Listeners called with a Buffer
instance.error
— Relayed when the underlying http.ClientRequest
emits the same event
or when the response status code is not in the 200s. Listeners called with an
Error
instance (in the first case) or the response status code.close
— Relayed when the underlying stream.Duplex
emits the same event.You can define options accepted by the request module besides from the options below.
Type: Boolean
Default: false
If set to true
, try extracting the file using decompress.
Type: String
Default: undefined
Sometimes you may be downloading an application/octet-stream
and you want to
extract it, eg it may be a zip, this option allows you to specify the extention
of the file to be downloaded.
Type: String
Default: undefined
Set mode on the downloaded files.
Type: Number
Default: 0
Equivalent to --strip-components
for tar.
$ npm install --global download
$ download --help
Usage
$ download <url>
$ cat <file> | download>
Example
$ download --out dist --extract https://github.com/kevva/download/archive/master.zip
$ cat urls.txt | download --out dist
Options
-e, --extract Extract archive files on download
-o, --out Path to download or extract the files to
-s, --strip <number> Strip path segments from root when extracting
MIT © Kevin Mårtensson
FAQs
Download and extract files
The npm package download receives a total of 1,668,010 weekly downloads. As such, download popularity was classified as popular.
We found that download demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.