Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
gulp-npmrun
Advanced tools
Plugin to spawn a CLI program for piping with gulp. Uses spawn.
gulp-spawn options follow
child_process.spawn
conventions.
Not all CLI programs support piping. In fact, many newer ones don't. Some programs require that you pass certain arguments if you intend to use stdin and/or stdout. Please check the documentation of the program you intend to use to ensure piping is supported.
The following example pipes image files to ImageMagick's convert
. In the case
of convert
, you must specify a -
before arguments and after arguments if
you wish to use stdin and stdout, respectively.
var spawn = require("gulp-spawn");
// example using ImageMagick's convert
// setting "buffer: false" optional but recommended for heavy I/O
gulp.src("./src/images/*.{jpg,png,gif}", { buffer: false })
.pipe(spawn({
cmd: "convert",
args: [
"-",
"-resize",
"50%",
"-"
],
// optional
filename: function(base, ext) {
return base + "-half" + ext;
}
}))
.pipe(gulp.dest("./dist/images/"));
If you write spawn programs please consider taking the time to support stdin & stdout. Piping is one of the many reasons UNIX systems have endured the test of time.
v0.1.0 - Initial Release
v0.2.0 - Added filename
callback option
v0.2.1 - Fixed support for streams. Effeciency improvements.
v0.3.0 - Latest stream support and error emits.
FAQs
npm-run plugin for gulp
The npm package gulp-npmrun receives a total of 0 weekly downloads. As such, gulp-npmrun popularity was classified as not popular.
We found that gulp-npmrun demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.