
Security News
Crates.io Users Targeted by Phishing Emails
The Rust Security Response WG is warning of phishing emails from rustfoundation.dev targeting crates.io users.
npm-metadata
Advanced tools
A lightweight Node.js utility to fetch metadata for any npm package. Works both as a CLI tool and as an ES module.
Install globally via npm:
npm install -g npm-metadata
Or use it directly with npx:
npx npm-metadata -n <package-name> [-d <download-path>]
Fetch and show metadata, or download it as JSON.
npm-metadata -n <package-name> [-d <download-path>]
-n, --name <name>
-d, --download [path]
<download-path>/<package-name>.json
.path
is omitted, defaults to current working directory.Fetch metadata for express
and log it:
npm-metadata -n express
Fetch metadata and save it to ./data/express.json
:
npm-metadata -n express -d ./data
Use npm-metadata
directly in your JavaScript/TypeScript code via ESM import:
import { metadata } from "npm-metadata";
async function showLatest(tag) {
const data = await metadata(tag);
if (data && data["dist-tags"] && data["dist-tags"].latest) {
console.log(`Latest version of ${tag}:`, data["dist-tags"].latest);
} else {
console.error("Failed to retrieve metadata for", tag);
}
}
showLatest("react");
metadata(name: string) → Promise<any>
fetch
to get data from https://registry.npmjs.org/<name>
.async function metadata(name: string): Promise<any>
Fetches metadata for the given npm package name.
Parameters:
name
— the package identifier (e.g., express
, lodash
).Returns:
Errors:
undefined
if fetch fails or no name is provided.Console output (without -d
):
Fetching package metadata for: express
Package metadata fetched successfully.
Use the -d option to download the package metadata.
Successful download:
Fetching package metadata for: express
Package metadata fetched successfully.
Package metadata for express downloaded to /path/to/express.json
Licensed under MIT. Contributions via issues or pull requests are welcome.
Mode | Command / Code |
---|---|
CLI fetch | npm-metadata -n <pkg> |
CLI download | npm-metadata -n <pkg> -d ./some-folder |
ES Module | import { metadata } from 'npm-metadata'; await metadata('pkg') |
FAQs
Fetch and inspect npm package metadata in JSON
We found that npm-metadata demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
The Rust Security Response WG is warning of phishing emails from rustfoundation.dev targeting crates.io users.
Product
Socket now lets you customize pull request alert headers, helping security teams share clear guidance right in PRs to speed reviews and reduce back-and-forth.
Product
Socket's Rust support is moving to Beta: all users can scan Cargo projects and generate SBOMs, including Cargo.toml-only crates, with Rust-aware supply chain checks.