
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
ender-package-util
Advanced tools
A component of the Ender CLI, providing utilities for working with npm packages, including Ender-specific package.json files.
This package is used by the ender-repository to provide an interface to npm for the Ender CLI.
For more information check out http://ender.jit.su
cleanName()
will provide a plain package name given a package name with version and/or tag. So 'bean@0.4.5'
becomes 'bean'
. Can also operate on an array of names and will return an array of cleaned names.
isPath()
returns a boolean when given a package name or path to a package to indicate whether this package is a path or a package in the repository.
isPath('bean') // → false
isPath('bean@0.5.0') // → false
isPath('/path/to/pkg') // → true
isPath('../foo') // → true
getPackageRoot()
will return an absolute path to the installed 'package' given an array of its parent packages. This is mainly a utility to navigate through npm's node_modules directory structure.
getPackageRoot([], 'bean')
// → /absolute/path/to/node_modules/bean/
getPackageRoot([ 'foo', 'bar' ], 'baz')
// → /absolute/path/to/node_modules/foo/node_modules/bar/node_modules/baz/
readPackageJSON()
uses getPackageRoot()
to locate the package.json file for the given package and then return it modfied for use by Ender.
Given a standard package.json file, the following keys will be replaced if they exist in either the "ender" subkey, or the *"overlay"->"ender" sub-subkey:
This allows package owners to provide packages that differ when used in Node and in Ender.
For example, given a package.json:
{
"name": "foo",
"main": "foo.js",
"ender": {
"main": "bar.js",
"bridge": "ender.js"
}
}
You will actually end up with a structure that looks like this, once processed:
{
"name": "foo",
"main": "bar.js",
"bridge": "ender.js"
}
The original, unmolested, deserialized package.json structure is available on the prototype of the returned object, e.g.:
readPackageJSON([], 'bean', function (err, packageJSON) {
var original = Object.getPrototypeOf(packageJSON)
})
getDependenciesFromJSON()
gets a simple array of dependency package names (not cleaned), from the package descriptor (package.json). It will always return an array, even if it's empty.
getDependenciesFromDirectory()
given a package and its parents (in an array, as in getPackageRoot()
), find a list of dependencies in the node_modules directory.
preparePackagesDirectory()
is a simple utility to set up node_modules if it doesn't already exist. It is necessary for the Ender CLI to make this directory under the current working directory, otherwise npm will search for a node_modules directory in the parent directories and use that instead.
Contributions are more than welcome! Just fork and submit a GitHub pull request! If you have changes that need to be synchronized across the various Ender CLI repositories then please make that clear in your pull requests.
Ender Package Util uses Buster for unit testing. You'll get it (and a bazillion unnecessary dependencies) when you npm install
in your cloned local repository. Simply run npm test
to run the test suite.
Ender Package Util is Copyright (c) 2012 @rvagg, @ded, @fat and other contributors. It is licenced under the MIT licence. All rights not explicitly granted in the MIT license are reserved. See the included LICENSE file for more details.
FAQs
Package utilities for the Ender CLI
The npm package ender-package-util receives a total of 1 weekly downloads. As such, ender-package-util popularity was classified as not popular.
We found that ender-package-util demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.