
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
npm-i-progress
Advanced tools
Run npm install with a real progress bar based on live fetch/extract events.
Run npm install
with a live progress bar based on real fetch/extract events from npm’s --verbose
output.
No fake timers — the total grows as sub-dependencies are discovered.
npm install
runs--legacy-peer-deps
, package names, etc.)Global (recommended):
npm i -g npm-i-progress
One-off:
npx npm-i-progress
Inside any Node project directory:
npm-i-progress
Or use the short alias:
npi
Pass through any args you’d normally give npm install
:
npm-i-progress --legacy-peer-deps
npm-i-progress react react-dom
This CLI spawns:
npm install --verbose
and parses lines that indicate fetch/resolve (to grow the total) and extract/install (to increment completed).
The bar updates continuously without resetting on warnings.
Note: npm doesn’t expose an official progress API.
This uses heuristic parsing and may vary slightly by npm version.
If your logs look different, please open an issue with a snippet.
Does it replace npm install
?
No. It wraps npm install
and shows progress; it passes through args and exit codes.
Can I use it in CI?
Yes, but progress bars aren’t very useful in plain logs.
(A future update may auto-disable when CI=true
.)
Why does total package count grow while running?
npm discovers sub-dependencies as it resolves the tree, so the total increases dynamically — that’s expected and more accurate than a fixed guess.
npm un -g npm-i-progress
--verbose
output in an issue; we’ll expand our matchers.MIT © 2025 Mohammed Suhail Roushan Ali
FAQs
Run npm install with a real progress bar based on live fetch/extract events.
We found that npm-i-progress demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.