
Product
Introducing Pull Request Stories to Help Security Teams Track Supply Chain Risks
Socket’s new Pull Request Stories give security teams clear visibility into dependency risks and outcomes across scanned pull requests.
find-npm-assets
Advanced tools
Recursively find assets in npm packages.
To define assets in a package, add an assets
field to the package.json
containing an array of file globs to include.
Let's say you have a package named my-site
, which contains some assets and npm dependencies that in turn contain additional assets:
{
"name": "mysite",
"assets": [
"src/app/assets/**/*",
"logo.png"
],
"dependencies": {
"mysite-dep": "*"
}
}
{
"name": "mysite-dep",
"assets": "background.jpg"
}
You could retrieve all your project assets with:
var assets = require('find-npm-assets').load();
// Example output:
// ["src/app/assets/**/*", "logo.png", "background.jpg"]
Integrating find-npm-assets with gulp is extremely easy. The following gulp task copies all your project assets to a destination folder:
var assets = require('find-npm-assets').load();
gulp.task('assets', function() {
gulp.src(assets)
.pipe(gulp.dest('build/assets'))
});
For projects with assets coming from multiple packages it is recommended to set the pkgDir
property, which allows assets to be organized by project name:
var assets = require('find-npm-assets').load({pkgDir: true});
gulp.task('assets', function() {
assets.forEach(function(pkg){
gulp.src(pkg.assets).pipe(gulp.dest('build/assets/' + pkg.name));
});
})
// Example output:
// [{
// name: project1,
// assets: ["src/app/assets/**/*", "logo.png", "background.jpg"]
// }, {
// name: project2,
// assets: ["src/app/assets/**/*", "logo.png", "background.jpg"]
// }]
To output debug information, pass an object with a debug
property set to true to the load
method:
var assetFind = require('find-npm-assets');
assetFind.load({debug: true});
You can run find-npm-assets
from the command line, the -v
argument will trigger debug information and -m
will trigger the pkgDir
option.
See LICENSE file.
FAQs
Recursively find assets in node modules
We found that find-npm-assets demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Product
Socket’s new Pull Request Stories give security teams clear visibility into dependency risks and outcomes across scanned pull requests.
Research
/Security News
npm author Qix’s account was compromised, with malicious versions of popular packages like chalk-template, color-convert, and strip-ansi published.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.