
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
electron-apis
Advanced tools
A JSON object describing Electron's APIs.
See apis.json or explore the object in the node repl:
npm i -g trymodule && trymodule electron-apis
The module exports a function that parses markdown docs in a given directory, then returns a JSON representation of the docs.
npm install electron-apis --save
const lint = require('electron-apis')
const docPath = './vendor/electron/docs/api'
lint(docPath).then(function (apis) {
// `apis` is an array of API objects. To find one:
const win = apis.find(api => api.name === 'BrowserWindow')
win.events.length
// => 25
win.events[0]
// {
// "name": "page-title-updated",
// "description": "Emitted when the document...",
// "returns": [
// {
// "name": "event",
// "type": "Event"
// }
// ]
// }
win.instanceMethods[20]
// {
// name: 'setSize',
// signature: '(width, height[, animate])'
// }
})
The linter starts with a list of all the API names as well as booleans indicating if they're available on the Main Process or the Renderer Process (or both).
Each API's structure is inferred by parsing its raw markdown documentation from the electron repo. The electron-docs module abstracts away the challenges of fetching file contents in bulk.
Electron's API documentation adheres to Electron Coding Style and the Electron Styleguide, so its content can be programmatically parsed. To make the content easy to parse, the raw markdown is converted to HTML using marky-markdown-lite, which returns a cheerio DOM object that can be queried and traversed using familiar CSS selectors.
The result is an array of APIs. The following metadata is included for each API, where appropriate:
None
_.find exported as a module.MIT
FAQs
A JSON object describing Electron's APIs
We found that electron-apis demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.