
Research
Node.js Fixes AsyncLocalStorage Crash Bug That Could Take Down Production Servers
Node.js patched a crash bug where AsyncLocalStorage could cause stack overflows to bypass error handlers and terminate production servers.
list-exports
Advanced tools
Given a package name and a version number, or a path to a package.json, what specifiers does it expose?
Given a path to a package.json, what specifiers does it expose?
The package export defaults an async function. It takes a path to a package.json as the only required argument.
It fulfills with an object with the following structure:
name the package nameversion: the package versionengines: the package's engines requirementsproblems: a Set of strings describing problems or validation issues encountered during exports traversal. Note that these errors do not necessarily interfere with the listed entry points being accessible at runtime.exports: an object with the following structure:
binaries: a Map of executable program names, to the relative file path that name will execute.latest: a string describing the latest “category” in the given node version range. This category will be present in the following list....categories: each category that the node version range overlaps will have an object with this structure:
import: a Map of import specifier, to relative file pathrequire: a Map of require specifier, to relative file pathfiles: a Set of relative file paths that are included in import and/or requiretree: a Map. Its keys are filenames (no leading ./), whose values are a Set of import or require specifiers that point to it; or, directory names, whose values are a Map of the same recursive structure as tree itself.pre-exports: this category will always be present, whether it's in the above list or not, with the above structure.In addition to the required package.json path, it also takes a second argument, an options object. This object supports the following properties:
node: either true, which reads the engines.node field in package.json, or a valid semver range of node versions to target. Defaults to the current node version.const expected = {
name: 'list-exports',
version: '1.1.0',
engines: { node: '^18.17.0 || >=20.5.0' },
problems: new Set(),
exports: {
binaries: {},
latest: 'pattern-trailers-no-dir-slash',
'pattern-trailers-no-dir-slash': {
import: new Map([
['.', './index.js'],
]),
require: new Map([
['.', './index.js'],
['./package.json', './package.json'],
]),
files: new Set([
'./index.js',
'./package.json',
]),
tree: new Map([
['index.js', new Set(['.'])],
['package.json', new Set(['./package.json'])],
]),
},
'pre-exports': {
import: new Map(),
require: new Map([
['.', './index.js'],
['./', './index.js'],
['./index', './index.js'],
['./index.js', './index.js'],
['./package', './package.json'],
['./package.json', './package.json'],
]),
files: new Set([
'./index.js',
'./package.json',
]),
tree: new Map([
['index.js', new Set([
'.',
'./',
'./index.js',
'./index',
])],
['package.json', new Set([
'./package.json',
'./package',
])],
]),
},
},
};
const assert = require('assert');
const path = require('path');
const listExports = require('list-exports');
listExports('./package.json', { node: true }).then((data) => {
assert.deepEqual(data, expected);
}).catch((e) => {
console.error(e);
process.exit(1);
});
FAQs
Given a package name and a version number, or a path to a package.json, what specifiers does it expose?
We found that list-exports demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Node.js patched a crash bug where AsyncLocalStorage could cause stack overflows to bypass error handlers and terminate production servers.

Research
/Security News
A malicious Chrome extension steals newly created MEXC API keys, exfiltrates them to Telegram, and enables full account takeover with trading and withdrawal rights.

Security News
CVE disclosures hit a record 48,185 in 2025, driven largely by vulnerabilities in third-party WordPress plugins.