
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
npm-research
Advanced tools
Nice little utility to help you research NPM packages.
You don't want to always reinvent the wheel do you? Neither do I. Well, this will help you research NPM packages a bit more. It does this by performing npm search and then parsing out the package names and retreiving the homepage and repository urls. It can then open up the repo urls in your browser. This way you can see how many stars the project has and investigate the quality of the code and documentation.
npm install -g npm-research
$ npm-research
npm-research [0.1.0]
Usage: npm-research [some search terms...] [options]
Options:
-b, --browser Open repos in browser
-g, --gte [num] Only display/open those who have a dependents greater than specified number i.e. more popular
Perform basic research. Find the package name and description. Show the number of packages that depend upon the package. This way you can gauge popularity of the package.
$ npm-research string csv
Searching...
name deps description
a-csv [0] : A CSV parsing/stringify module
csvrow [0] : parse a CSV row string
string [16] : string contains methods that aren't included in the vanilla JavaScript string such as escaping HTML, decoding HTML entities, stripping tags, etc.
Done.
Perform research, but filter out projects that have less than 1 depenedent. Open the repositories in your browser so that you can investigate the code.
$ npm-research string csv --gte 1 --browser
Searching...
name deps description
string [16] : string contains methods that aren't included in the vanilla JavaScript string such as escaping HTML, decoding HTML entities, stripping tags, etc.
Done.
After each NPM package information is downloaded, it is then cached for two days. This information can be found in $HOME/.npm-research/packages.json.
Unfortunately npm search is slows balls and TJ Holowaychuk's npm-search isn't working right now. Maybe leverage Google search to speed things up?
(MIT License)
Copyright 2012, JP Richardson jprichardson@gmail.com
FAQs
Nice little utility to help you research NPM packages.
We found that npm-research demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.