
Research
/Security News
Weaponizing Discord for Command and Control Across npm, PyPI, and RubyGems.org
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
Make npm3's flat dependencies easier to find and sort
npm3
has flat dependency trees, this is a good thing for many reasons.
Unfortunately, this means your node_modules
folder might contain hundreds (or thousands?)
of modules and that makes it difficult to quickly debug/hack on issues with top-level dependencies.
Puts color tags on your top-level dependencies and devDependencies, making top-level dependencies easier to find and sort in Finder.
If you often use the terminal instead of finder then you can also do ls -l | grep @
to list the folders with tags.
Hides away non top-level dependencies and devDependencies, leaving you with just the modules that are important to you.
Note: This project is currently OS X & Windows only, but if you have ideas on how something similar could be implemented on Linux or other platforms then create an issue.
$ npm install --global john
$ john --help
Make npm3's flat dependencies easier to find and sort
Usage
$ john
Options
--clear Clear all tags. [Default: false]
--deps Color for dependencies. [Default: blue]
--dev-deps Color for devDependencies. [Default: yellow]
Available Colors:
gray, green, purple, blue, yellow, red, orange, clear.
Examples
$ john
Tagged 4 dependencies as blue
Tagged 2 devDependencies as yellow
$ john --clear
Removed 4 tags from dependencies
Removed 2 tags from devDependencies
$ john --deps=purple --dev-deps=gray
Tagged 4 dependencies as purple
Tagged 2 devDependencies as gray
> john --help
Make npm3's flat dependencies easier to find and sort
Usage
> john
Options
--clear Clear all hidden dependencies. [Default: false]
--deps Hide dependencies. [Default: false]
--dev-deps Hide devDependencies. [Default: false]
Examples
$ john
Hid 4 dependencies
$ john --clear
Unhid 4 dependencies
$ npm install --save john
const john = require('john');
john('/path/to/project').then(
(result) => console.log(result)
// {
// dependencies: [
// { code: 0,
// command: 'xattr …',
// path: '/path/to/project/node_modules/finder-tag',
// tag: 'blue',
// module: 'finder-tag'
// },
// {…},
// {…}
// ],
// devDependencies: [
// {…},
// {…}
// ]
// }
)
Type: string
The path to your project's directory (that contains package.json
).
Type: boolean
Default: false
Clear all tags / show all dependencies.
Note: OSX Only
Type: string
Default: blue
Color tag to use for dependencies. See available colors.
Note: OSX Only
Type: string
Default: yellow
Color tag to use for devDependencies. See available colors.
Note: Windows only
Type: boolean
Default: false
Set to true
to hide dependencies
Note: Windows only
Type: boolean
Default: false
Set to true
to hide dev dependencies
Note: OSX only
Asking the important questions! 'John' like 'Johnny' like 'Johnny Depp' like 'Dep[p]endency'. Pfft, mainly because it was short, simple and not already taken.
Special thanks to @EnzoMartin for doing the Windows work.
MIT © DaveJ
FAQs
Make npm3's flat dependencies easier to find and sort
We found that john demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
Security News
Socket now integrates with Bun 1.3’s Security Scanner API to block risky packages at install time and enforce your organization’s policies in local dev and CI.
Research
The Socket Threat Research Team is tracking weekly intrusions into the npm registry that follow a repeatable adversarial playbook used by North Korean state-sponsored actors.