
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
lifion-verify-deps
Advanced tools
Verifies that installed NPM modules are the latest currently available version.
Verifies that installed NPM modules are the latest currently available version.
To install the module:
npm install lifion-verify-deps --global
To run command:
lifion-verify-deps
To use as module:
const verifyDeps = require('lifion-verify-deps');
verifyDeps({ dir: './path-to/project-directory' })
.then(() => /* all installed packages up to date */)
.catch((err) => /* there are packages to be updated */)
Promise.<Array.<string>>Promise.<string>Promise.<string>string | nullArray.<Promise.<PackageStatus>>stringObject.<string, string> | ObjectVerifies the dependencies listed in the package.json of the given directory.
Kind: Exported function
| Param | Type | Default | Description |
|---|---|---|---|
| [options] | Object | Optional parameters. | |
| [options.autoUpgrade] | boolean | false | Automatically upgrade all suggested dependencies. |
| [options.dir] | string | The path where to look for the package.json file. | |
| [options.logger] | Logger | A logger instance, with a similar API as the console object. |
Validates package name.
Kind: inner method of verifyDeps
Throws:
Error - Package name is invalid.| Param | Type | Description |
|---|---|---|
| name | string | Package name. |
Promise.<Array.<string>>Gets available versions for provided package name.
Kind: inner method of verifyDeps
Returns: Promise.<Array.<string>> - - List of available versions.
Throws:
Error - Output failed JSON parse.| Param | Type | Description |
|---|---|---|
| name | string | Package name. |
Promise.<string>Gets latest tag from provided package name.
Kind: inner method of verifyDeps
Returns: Promise.<string> - - Return latest version, if latest tag exists.
Throws:
Error - Output failed JSON parse.| Param | Type | Description |
|---|---|---|
| name | string | Package name. |
Promise.<string>Finds valid upgrade version of the provided package name.
Kind: inner method of verifyDeps
Returns: Promise.<string> - - Valid upgrade version.
Throws:
Error - Outdated version in package.json, version was likely unpublished.| Param | Type | Description |
|---|---|---|
| name | string | Package name. |
| wanted | string | Package version. |
string | nullGets currently installed version for provided package name.
Kind: inner method of verifyDeps
Returns: string | null - - Installed version or null if not installed.
Throws:
Error - Unable to find installed versions, try installing node modules by running npm i.| Param | Type | Description |
|---|---|---|
| currentDir | string | Path to package.json directory. |
| name | string | Package name. |
| logger | Logger | Logger flag. |
Array.<Promise.<PackageStatus>>Builds list of packages to update.
Kind: inner method of verifyDeps
Returns: Array.<Promise.<PackageStatus>> - - NPM package state.
| Param | Type | Description |
|---|---|---|
| params | Object | Object with parameters. |
| params.deps | Object.<string, string> | List of dependencies. |
| params.dir | string | Directory location. |
| params.logger | Logger | Logging tool. |
| params.type | string | Type of dependency. |
stringFormats package name for installation.
Kind: inner method of verifyDeps
Returns: string - - Concatenated 'name@latest' for provided package.
| Param | Type | Description |
|---|---|---|
| filteredPkgs | Array.<PackageStatus> | Package properties. |
Object.<string, string> | ObjectFilters out dependencies with locked versions.
Kind: inner method of verifyDeps
Returns: Object.<string, string> | Object - List of dependencies excluding locked semver versions.
| Param | Type | Description |
|---|---|---|
| deps | Object.<string, string> | List of dependencies. |
FAQs
Verifies that installed NPM modules are the latest currently available version.
The npm package lifion-verify-deps receives a total of 28 weekly downloads. As such, lifion-verify-deps popularity was classified as not popular.
We found that lifion-verify-deps demonstrated a not healthy version release cadence and project activity because the last version was released a year ago.Β It has 5 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.