
Security News
gem.coop Tests Dependency Cooldowns as Package Ecosystems Move to Slow Down Attacks
gem.coop is testing registry-level dependency cooldowns to limit exposure during the brief window when malicious gems are most likely to spread.
nice-package
Advanced tools
Clean up messy package metadata from the npm registry
The package data served by the npm registry is messy and confusing. The folks at npm, Inc maintain a tool called normalize-package-data which does a lot of work to clean this data up, but the resulting object is still a bit confusing.
nice-package uses normalize-package-data as a starter, then does even more
package cleanup:
doc['dist-tags'].latest as the baseline for package metadatastarsCount from the users objectversions array from the time object_npmUser to lastPublisher, because it's a more intuitive name.maintainers to owners, for consistency with the CLI commands.https format_id and _from into an other object that can easily be omitted.npm install nice-package --save
nice-package exports a class. To create a new package instance,
call new Package(doc), where doc is a JSON package object from the npm registry:
const got = require('got')
const Package = require('nice-package')
got('https://registry.npmjs.com/express', {json: true})
.then(function (doc) {
var pkg = new Package(doc)
console.log(JSON.stringify(pkg, null, 2))
})
You can also instantiate a nice package from package.json data:
const Package = require('nice-package')
const pkg = new Package(require('node_modules/express/package.json'))
pkg.dependsOn('array-flatten')
// => true
You can pick specific properties to return:
const pkg = new Package(pkgData, {pick: ['name', 'description']})
// {
// name: 'tlds',
// description: 'List of TLDs'
// }
or you can omit properties.
Sometimes you don't want the other data, the readme, etc.
const pkg = new Package(pkgData, {omit: ['other', 'readme', 'versions']})
Note: pick and omit will also accept comma-delimited strings instead
of arrays. This works nicely if you're using query params from a URL as options to
nice-package:
const pkg = new Package(pkgData, {omit: 'other,readme,versions'})
A nice package comes with convenience methods:
pkg.mentions(query)query StringPerforms a case-insensitive search against the JSON-stringified object. Returns a Boolean indicating whether the given query is present in the object.
pkg.dependsOn(pkgName)pkgName String - The name of another packageReturns a Boolean indicating whether the given pkgName is listed in dependencies.
pkg.devDependsOn(pkgName)pkgName String - The name of another packageReturns a Boolean indicating whether the given pkgName is listed in devDependencies.
pkg.somehowDependsOn(pkgName)pkgName String - The name of another packageReturns a Boolean indicating whether the given pkgName is listed in
dependencies or devDependencies.
pkg.depNamesA getter method that returns an array of the dependencies keys.
pkg.devDepNamesA getter method that returns an array of the devDependencies keys.
pkg.allDepNamesA getter method that returns an array of all the dependencies and
devDependencies keys.
nice-package uses a JSON schema to validate packages.
The following properties are required:
name Stringdescription Stringversion StringTo determine if a package is valid, use the pkg.valid getter method:
pkg.valid
// => false
To see validation errors on a package, use the pkg.validationErrors getter method:
pkg.validationErrors
The result is an array of revalidator errors.
npm install
npm test
MIT
💛 Thanks to emilyrose for giving up
the nice-package name on npm.
Generated by package-json-to-readme
FAQs
Clean up messy package metadata from the npm registry
The npm package nice-package receives a total of 56 weekly downloads. As such, nice-package popularity was classified as not popular.
We found that nice-package demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
gem.coop is testing registry-level dependency cooldowns to limit exposure during the brief window when malicious gems are most likely to spread.

Security News
Following multiple malicious extension incidents, Open VSX outlines new safeguards designed to catch risky uploads earlier.

Research
/Security News
Threat actors compromised four oorzc Open VSX extensions with more than 22,000 downloads, pushing malicious versions that install a staged loader, evade Russian-locale systems, pull C2 from Solana memos, and steal macOS credentials and wallets.