
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
npm-shrinkwrap-install
Advanced tools
Automatic synchronise shrinkwrap file with package install/update/uninstall
Automatic synchronise shrinkwrap file with package install/update/uninstall.
$ npm install npm-shrinkwrap-install -g
This is a CLI-only package (for now).
$ npm-install babel@latest --save
You could manually alter the version in package.json and run npm-install
as well.
Notice:
Before updating shrinkwrap, the script will try to verify node_modules content with your package.json. Which means:
dependencies
will be pruned. So it is mandatory to use --save
when installing new packages.$ npm-uninstall babel --save
Shrinkwrap file will be automatically in sync with your dependencies in package.json.
Notice:
If --save
is omitted, the script will generate an error since node_modules content does not agree with your package.json.
$ npm-shrinkwrap
npm-install
npm-i
Accepts all arguments for npm install
npm-uninstall
npm-un
npm-remove
npm-rm
npm-r
Accepts all arguments for npm uninstall
npm-shrinkwrap
Accepts all arguments for Uber's npm-shrinkwrap
This script is largely based on Uber's npm-shrinkwrap. At the time of the writing, their tool does not support scoped package. A pull-request is created to rectify this issue and yet to be accepted.
As a temporary measure, I've forked their project and applied my patch to support scoped package: @th507/npm-shrinkwrap. npm-shrinkwrap-install
is currently dependent upon @th507/npm-shrinkwrap.
Copyright (c) 2015 Jingwei "John" Liu
Licensed under the MIT license.
FAQs
Automatic synchronise shrinkwrap file with package install/update/uninstall
The npm package npm-shrinkwrap-install receives a total of 0 weekly downloads. As such, npm-shrinkwrap-install popularity was classified as not popular.
We found that npm-shrinkwrap-install demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.