
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
imagemagick-cli
Advanced tools
Access the ImageMagick CLI tools from Node. Cross-platform, with support for ImageMagick 6 and 7.
Access the ImageMagick CLI tools from Node. Cross-platform, with support for ImageMagick 6 and 7.
This library is designed to provide a safe and platform independent way of calling the ImageMagick CLI tools.
It is safe because it correctly deals with the Windows convert issue. It is platform independent because you don't have to worry about how it deals with the issue.
Install with npm:
npm install --save imagemagick-cli
To call an ImageMagick CLI tool, just run:
const imagemagickCli = require('imagemagick-cli');
imagemagickCli.exec('convert -version');
This command will work consistently on MacOSX, Windows and Linux. On Windows, it will not conflict with the system installed convert.exe tool.
This libary is tested with the following platforms and ImageMagick versions:
| Platform | ImageMagick Version |
|---|---|
| OSX | 6 âś… |
| OSX | 7 âś… |
| Ubuntu | 6 âś… |
| Ubuntu | 7 âś… |
| Windows | 6 âś… |
| Windows | 7 âś… |
Execute a command:
imagemagickCli
.exec('convert -version')
.then(({ stdout, stderr }) => {
console.log(`Output: ${stdout}`);
});
Check the ImageMagick version:
imagemagickCli
.getVersion()
.then((version) => {
console.log(`Version: ${version}`);
});
If the version cannot be identified (most likely because ImageMagick is not installed) then the function resolves with null.
This library uses the node-debug module. To see low-level debugging information when using this library, set imagemagick-cli as part of the DEBUG environment variable:
DEBUG=imagemagick-cli node ./my-script.js
With debugging enabled, the full command sent to the CLI, as well as all stderr and stdout output is shown in the log.
I made this library to deal with some issues relating to Windows in the app-icon project, which I didn't have to deal with again in other projects (like app-splash.
There are some great and sophisticated modules around for working with IM:
I decided to create my own library because I don't need apis for ImageMagick in my use cases, just a platform agnostic way to call the CLI tools. The design goals for this project are that it allows you to run IM CLI tools without having to worry about platform or version nuances, that's it.
If you need more functionality I recommend looking into the projects above.
The only dependencies are Node 6 (or above).
Useful commands for development are:
| Command | Usage |
|---|---|
npm test | Runs the unit tests. |
npm run test:debug | Runs the tests in a debugger. Combine with .only and debugger for ease of debugging. |
npm run cov | Runs the tests, writing coverage reports to ./artifacts/coverage. |
npm run lint | Lint the code, using airbnb. |
To create a release.
npm run release to bump and update the changeloggit push --follow-tags && npm publishMIT
FAQs
Access the ImageMagick CLI tools from Node. Cross-platform, with support for ImageMagick 6 and 7.
The npm package imagemagick-cli receives a total of 13,243 weekly downloads. As such, imagemagick-cli popularity was classified as popular.
We found that imagemagick-cli demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.