
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
An API for MIME type information.
[!Note]
mime@4is nowlatest. If you're upgrading frommime@3, note the following:
mime@4is API-compatible withmime@3, withonetwo exceptions:
- Direct imports of
mimeproperties no longer supportedmime.define()cannot be called on the defaultmimeobject- ESM module support is required. ESM Module FAQ.
- Requires an ES2020 or newer runtime
- Built-in Typescript types (
@types/mimeno longer needed)
npm install mime
For the full version (800+ MIME types, 1,000+ extensions):
import mime from 'mime';
mime.getType('txt'); // ⇨ 'text/plain'
mime.getExtension('text/plain'); // ⇨ 'txt'
mime/lite is a drop-in mime replacement, stripped of unofficial ("prs.*", "x-*", "vnd.*") types:
import mime from 'mime/lite';
mime.getType(pathOrExtension)Get mime type for the given file path or extension. E.g.
mime.getType('js'); // ⇨ 'text/javascript'
mime.getType('json'); // ⇨ 'application/json'
mime.getType('txt'); // ⇨ 'text/plain'
mime.getType('dir/text.txt'); // ⇨ 'text/plain'
mime.getType('dir\\text.txt'); // ⇨ 'text/plain'
mime.getType('.text.txt'); // ⇨ 'text/plain'
mime.getType('.txt'); // ⇨ 'text/plain'
null is returned in cases where an extension is not detected or recognized
mime.getType('foo/txt'); // ⇨ null
mime.getType('bogus_type'); // ⇨ null
mime.getExtension(type)Get file extension for the given mime type. Charset options (often included in Content-Type headers) are ignored.
mime.getExtension('text/plain'); // ⇨ 'txt'
mime.getExtension('application/json'); // ⇨ 'json'
mime.getExtension('text/html; charset=utf8'); // ⇨ 'html'
mime.getAllExtensions(type)[!Note] New in
mime@4
Get all file extensions for the given mime type.
mime.getAllExtensions('image/jpeg'); // ⇨ Set(3) { 'jpeg', 'jpg', 'jpe' }
Mime instancesThe default mime objects are immutable. Custom, mutable versions can be created as follows...
Create a new, custom mime instance. For example, to create a mutable version of the default mime instance:
import { Mime } from 'mime/lite';
import standardTypes from 'mime/types/standard.js';
import otherTypes from 'mime/types/other.js';
const mime = new Mime(standardTypes, otherTypes);
Each argument is passed to the define() method, below. For example new Mime(standardTypes, otherTypes) is synonomous with new Mime().define(standardTypes).define(otherTypes)
mime.define(type map [, force = false])[!Note] Only available on custom
Mimeinstances
Define MIME type -> extensions.
Attempting to map a type to an already-defined extension will throw unless the force argument is set to true.
mime.define({'text/x-abc': ['abc', 'abcd']});
mime.getType('abcd'); // ⇨ 'text/x-abc'
mime.getExtension('text/x-abc') // ⇨ 'abc'
$ mime scripts/jquery.js
text/javascript
$ mime -r image/jpeg
jpeg
The 'mime-types' package is similar to 'mime' in that it provides MIME type lookup based on file extension and vice versa. It is based on the mime-db dataset, which is a comprehensive dataset of MIME types compiled from various sources. Compared to 'mime', it might offer a more extensive and updated list of MIME types.
The 'file-type' package goes beyond simple MIME type lookup by extension; it can detect the actual MIME type of a file or a Buffer by checking the file's magic numbers (file signatures). This can be more reliable than 'mime' when dealing with files that have incorrect or missing extensions.
FAQs
A comprehensive library for mime-type mapping
The npm package mime receives a total of 88,281,149 weekly downloads. As such, mime popularity was classified as popular.
We found that mime demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.