
Security News
Another Round of TEA Protocol Spam Floods npm, But It’s Not a Worm
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.
list-feature-flags
Advanced tools
`list-feature-flags` is a command-line utility that searches through JavaScript and TypeScript files in a directory for feature flags and experiment keys, and outputs a sorted, unique list of them.
list-feature-flags is a command-line utility that searches through JavaScript and TypeScript files in a directory for feature flags and experiment keys, and outputs a sorted, unique list of them.
You can use this utility via npx without installing it:
npx list-feature-flags
Or, install it globally using npm:
npm install -g list-feature-flags
To use the utility, navigate to the directory containing your JavaScript or TypeScript files and run:
npx list-feature-flags --mode=featureFlags
Or, if you installed it globally:
list-feature-flags --mode=experiments
The utility allows two modes:
featureFlags: This mode will search for any words matching the regular expressions \bf_\w*\b and \bF\w*Feature\b, then applies a series of transformations to convert CamelCase to snake_case, lowercasing the string, removing the trailing _feature part and finally ensuring the flag starts with _f.
experiments: This mode will search for any words matching the regular expressions \be_\w*\b and \bE\w*Experiment\b, then applies a similar series of transformations as in featureFlags mode, but removes the trailing _experiment part and ensures the flag starts with _e.
In both modes, files in test, __mocks__, and node_modules directories are excluded from the search. The output lists are sorted and duplicates are removed.
If the --mode flag is not provided, the utility defaults to featureFlags.
Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change.
The project uses an automated GitHub Actions workflow to bump the npm package version and publish on pushes to the main branch when the latest commit message follows certain Conventional Commit prefixes.
The release logic inspects ONLY the latest commit on main:
Commit prefix / pattern -> Bump type:
feat!: or feat(scope)!: -> majorfix!: or fix(scope)!: -> majorfeat: / feat(scope): -> minorfix: / fix(scope): -> patchBREAKING CHANGE: -> major (even without !)If the last commit subject does not start with feat, fix, or their breaking variants, and there's no BREAKING CHANGE: line, the workflow skips versioning & publish.
feat: add color legend => minor bump (x.Y.z)
feat(parser)!: rewrite to support locales => major bump (X.y.z)
fix: correct null handling => patch bump (x.y.Z)
fix(api)!: remove deprecated endpoint => major
chore: update docs => no release
Commit body including:
BREAKING CHANGE: output format changed => major
ISC
FAQs
`list-feature-flags` is a command-line utility that searches through JavaScript and TypeScript files in a directory for feature flags and experiment keys, and outputs a sorted, unique list of them.
We found that list-feature-flags demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.

Security News
PyPI adds Trusted Publishing support for GitLab Self-Managed as adoption reaches 25% of uploads

Research
/Security News
A malicious Chrome extension posing as an Ethereum wallet steals seed phrases by encoding them into Sui transactions, enabling full wallet takeover.