
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
Hook and modify stdout and stderr
npm install hook-std
import assert from 'node:assert';
import {hookStdout} from 'hook-std';
const promise = hookStdout(output => {
promise.unhook();
assert.strictEqual(output.trim(), 'unicorn');
});
console.log('unicorn');
await promise;
You can also unhook using the second transform method parameter:
import assert from 'node:assert';
import {hookStdout} from 'hook-std';
const promise = hookStdout((output, unhook) => {
unhook();
assert.strictEqual(output.trim(), 'unicorn');
});
console.log('unicorn');
await promise;
Automatically collect output without a transform function:
import {hookStdout} from 'hook-std';
const promise = hookStdout();
console.log('unicorn');
console.log('rainbow');
console.log(promise.output); // 'unicorn\nrainbow\n'
promise.unhook();
await promise;
Hook streams in streams option, or stdout and stderr if none are specified.
Returns a Promise with a unhook() method which, when called, unhooks both stdout and stderr and resolves the Promise with an empty result. The returned promise also has an output property to access the collected output.
When hooking multiple streams, the output property contains the interleaved output in the order the writes occurred:
import {hookStd} from 'hook-std';
const promise = hookStd();
process.stdout.write('A');
process.stderr.write('B');
process.stdout.write('C');
console.log(promise.output); // 'ABC' (interleaved in order)
promise.unhook();
Hook stdout.
Returns a Promise with a unhook() method which, when called, unhooks stdout and resolves the Promise with an empty result. The returned promise also has an output property to access the collected output.
Hook stderr.
Returns a Promise with a unhook() method which, when called, unhooks stderr and resolves the Promise with an empty result. The returned promise also has an output property to access the collected output.
Type: object
Type: boolean
Default: true
Suppress stdout/stderr output.
Type: boolean
Default: false
Automatically unhook after the first call.
Type: stream.Writable[]
Default: [process.stdout, process.stderr]
The writable streams to hook. This can be useful for libraries allowing users to configure a writable stream to write to.
Type: Function
Receives stdout/stderr as the first argument and the unhook method as the second argument. Return a string to modify it. Optionally, when in silent mode, you may return a boolean to influence the return value of .write(…).
Output is automatically collected and can be accessed via the output property of the returned promise, regardless of whether a transform function is provided.
The capture-console package provides similar functionality to hook-std by allowing you to capture and manipulate stdout and stderr streams. However, it offers a simpler API and fewer customization options compared to hook-std.
The intercept-stdout package allows you to intercept and modify stdout and stderr streams. It is similar to hook-std but focuses more on simplicity and ease of use, with fewer advanced features.
The stdout-stderr package provides utilities to capture and manipulate stdout and stderr streams. It is similar to hook-std but offers a more straightforward API and is designed to be easy to integrate into testing frameworks.
FAQs
Hook and modify stdout and stderr
The npm package hook-std receives a total of 1,979,128 weekly downloads. As such, hook-std popularity was classified as popular.
We found that hook-std demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.