
Security News
Another Round of TEA Protocol Spam Floods npm, But It’s Not a Worm
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.
Run pkg.scripts subtasks in a runner-agnostic way (npm/yarn, whichever launched the main script)
You want to use pkg.scripts subtasks, but you don't want to commit to either npm run or yarn run? Look no further.
Given the following package.json
{
"name": "my-package",
"version": "1.0.0",
"license": "MIT",
"scripts": {
"task": "gosub subtask && gosub print done",
"subtask": "echo ====>> unix: $npm_config_user_agent win: %npm_config_user_agent% <<====",
"print":"echo"
},
"devDependencies": {
"gosub": "1.0.0"
}
}
After running npm install or yarn you get the following:
~/tmp ❯❯❯ yarn run --silent task
$ echo "====>> $npm_config_user_agent <<===="
====>> yarn/1.3.2 npm/? node/v8.9.1 darwin x64 <<====
$ echo done
done
and
~/tmp ❯❯❯ npm run --silent task
====>> npm/5.5.1 node/v8.9.1 darwin x64 <<====
done
In other words, if the main task is launched with npm run the sub tasks will be as well. If you launched it with yarn run, so will the subtasks (look between the ===>> arrows <<==== ).
This makes your pkg.scripts runner agnostic.
run?You can use gosub --raw action. So gosub --raw install will run npm install (re. bun, yarn, etc...).
$_ run subtask?It doesn't work on Windows (although it will save you tens if not hundreds of milliseconds on *nix). If it turns out there's a native, cross-platform method to achieve what gosub does please chime in in the issues.
The script works for my own use, but I'm not used to writing command line utilities and may have botched up some details that matter for your use case. For example, this has only been tested on MacOS, althought AFAICT there's nothing OS specific in the script. Feel free to open an issue if you have problems and/or suggestions.
gosub a BASIC thing?*Waves at all of you who learned to code on 8/16 bits computers*.
--raw option to launch other commands gosub --raw install will launch npm install (or bun, yarn depending on what you're using) .child_process.spawn instead of .exec to prevent the parent from exiting early.stdio streams rather than piping them manually.stdin to the children processes.initial release
Romantic WTF!
FAQs
Run pkg.scripts subtasks in a runner-agnostic way (npm/yarn, whichever launched the main script)
The npm package gosub receives a total of 10 weekly downloads. As such, gosub popularity was classified as not popular.
We found that gosub demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.

Security News
PyPI adds Trusted Publishing support for GitLab Self-Managed as adoption reaches 25% of uploads

Research
/Security News
A malicious Chrome extension posing as an Ethereum wallet steals seed phrases by encoding them into Sui transactions, enabling full wallet takeover.