
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
foreach-cli
Advanced tools
CLI utility to execute a command for each file matching a glob. Originally a fork of [each-cli][https://www.npmjs.com/package/each-cli], but then completely rewritten in order to provoke simplicity and eliminate annoying bugs. It differs form the original mainly by setting the CWD (current working directory) to the directory the foreach command was executed from, as opposed to the original package's behavior which set the CWD to the matched file's directory. It also takes the command arguments as strings to allow more complex commands such as piping.
npm install foreach-cli
Command Line
foreach -g <glob> -x <command to execute>
Command Line Options:
-g, --glob Specify the glob
-i, --ignore Glob ignore pattern(s)
-x, --execute Command to execute upon file addition/change
-c, --forceColor Force color TTY output (pass --no-c to disable)
-t, --trim Trims the output of the command executions to only show the first X characters of the output
-C, --concurrent Execute commands concurrently (pass --no-C to disable)
-h Show help
--version Show version number
Executing Command Placeholders
"path" - full path and filename
"root" - file root
"dir" - path without the filename
"reldir"- directory name of file relative to the glob provided
"base" - file name and extension
"ext" - just file extension
"name" - just file name
foreach -g "**/*.tar" -x "tar xvf #{path}"
foreach -g "*/*.jpg" -x "convert #{path}.jpg #{dir}/#{name}.converted.png"
FAQs
CLI util to execute a command for each file matching a glob
We found that foreach-cli demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.