
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
fh-npm speeds up npm installs by symlinking to already installed modules in the fh-npm cache if available, allowing node modules to be shared among multiple applications. fh-npm can be used instead of 'npm install', e.g.
<your-node-app-dir> $ fh-npm
If the packages referenced in your package.json have previously been installed by fh-npm, these will be symlinked to in your node_modules directory. Any packages not in the fh-npm cache will be installed via npm into the cache, and then symlinked to your local node_modules directory.
$ fh-npm --help
--help help
--version version information
--level=<level> logging level: fatal, error, warn, info, debug, trace. Default is fatal. Log output goes to stderr.
--cache=<cache-dir> The cache dir for fh-npm to use, defaults to $(HOME)/.fh-npm
--npm=<path-to-npm> The specific npm binary to use, helpful when working with multiple versions of node
--install=<npm-install-command> The npm 'install' command to use, defaults to 'install --production'
--clean Remove the node_modules dir before install
--copy Copy the files from the fh-npm cache into the users node_modules directory (instead of doing a symlink)
This is roughly how fh-npm works, see ./lib/install.js for specifics:
read the users package.json, then for each dependency:
check if the package is already in the cache: uses semver to compare the users requested package version with what's already in the cache. If there's a semver hit, the cached pacakge is used.
if the package is not in the cache, go an install it in the cache. This uses npm to do a normal install of the package@version in the fh-npm cache directory. It then moves the installed package to <fh-npm-cache>/<packge-name>/<version>/
.
Once the required package is in the cache ok, the symlink is made to it from the users node_modules directory.
According to semver *
means 'any version whatsoever'. So for example, if a users package.json contains "request": "*"
, this will match any version of the 'request' package that's already in the fh-npm cache. It is generally recommended that you don't use *
in your package.json.
NPM allows you to specify a URL or file reference for a package dependency instead of a specific version number, e.g.
"foo": "git://github.com/bar/foobar.git#master"
In this case, fh-npm will always 'npm install' the package into the fh-npm cache (fresh each time its called) and symlink to the exact version from there. In order to make best use of fh-npm, it is recommended that you try avoid using URLs or file references for your NPM packages.
If a npm-shrinkwrap.json file exists in the users directory, we simply run npm itself, i.e. fh-npm effectively isn't used and a normal npm install occurs.
Would be nice to be able to safely purge the fh-npm cache. This would involve removing any packages in the cache which have no symlinks pointing to their installation directories. This is not so trivial however, as explained in this SO article: http://stackoverflow.com/questions/4532241/linux-find-all-symlinks-of-a-given-original-file-reverse-readlink.
As explained above, fh-npm is effectively bypassed if shrinkwrap is used.
FAQs
FeedHenry NPM
The npm package fh-npm receives a total of 0 weekly downloads. As such, fh-npm popularity was classified as not popular.
We found that fh-npm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.