
Security News
Node.js Drops Bug Bounty Rewards After Funding Dries Up
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.
A CLI command to start up a node server, execute another CLI command (while node server is still running) and then exit the node server.
A CLI command to start up a node server, execute another CLI command (while node server is still running) and then exit the node server.
I created node-while for my specific use case - I wanted to start up my node server, run my integration tests and then stop the server (all via a single CLI command). This seemed like a reasonable way to do it + I thought it might be useful for someone else.
npm install node-while
To be used with node-while, your node server needs to do 2 things;
e.g.
//For ES6
import express from 'express';
const app = express();
const server = app.listen('8080', function () {
//2. emit a 'ready' event when server is ready for interaction
server.emit('ready');
});
//1. export the app instance as default
export default server;
//or for vanilla ES5
var express = require('express');
var app = express();
var server = app.listen('8080', function () {
//2. emit a 'ready' event when server is ready for interaction
server.emit('ready');
});
//1. export the app instance as default
exports.default = server;
You can use node-while like so
npx node-while -server ./src/myServer.js -run "echo squanch"
(concrete example) In my particular case I use node-while to run my cypress integration tests
npx node-while -s ./dist/server/index.js -run "npx cypress run"
See node-while -h for addition params
node-while doesnt currently have hooks for transpilers etc. Current recommendation is to transpile code e.g. with babel CLI (as your probably doing for production anyway) and then execute that with node-while.
FAQs
A CLI command to start up a node server, execute another CLI command (while node server is still running) and then exit the node server.
We found that node-while demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.