
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
oneclick-update
Advanced tools
Simple installer downloads and update server
Serves updates and installers following the common Squirrel + Electron pattern via Github releases.
In addition to the standard fare of these types of libraries it adds the ability to serve different release channels based on semver build metadata.
1.0.0+channelName -> /download/channelName/win32
It similarly handles prerelease channels, even prereleases on alternate channels.
2.0.0-1 -> /download/prerelease/win32
2.0.0-1+channelName -> /download/channelName/prerelease/win32
Both nuts and hazel are excellent libraries. That being said, here are some of the reasons you might use this instead.
.dmg or .pkg files for download/darwin routeJust running as a server, use any of these options to download the script. It's standalone.
curl -o oneclick.js https://raw.githubusercontent.com/doesdev/oneclick-update/master/index.jsIf you're using it as a module, you know the drill.
npm i -s oneclick-update
Just running as a server, couldn't be simpler.
curl -o oneclick.js https://raw.githubusercontent.com/doesdev/oneclick-update/master/index.js
SET GITHUB_REPO=doesdev/oneclick-release-test
node oneclick.js
Using a private repo, also simple.
curl -o oneclick.js https://raw.githubusercontent.com/doesdev/oneclick-update/master/index.js
curl -o secrets.json https://raw.githubusercontent.com/doesdev/oneclick-update/master/secrets.example.json
# modify the secrets.json file with your Github oauth token, repo, port, and return URL
node oneclick.js
GITHUB_REPO - Path to Github repo (i.e. doesdev/oneclick-update)GITHUB_OAUTH_TOKEN - Your Github oauth tokenPORT - The port you want to run the server onSERVER_URL - The URL of the update server (for proxying private release assets)REFRESH_CACHE - Interval to check for new releases as string or ms (default 15 mins)LOG_DOWNLOADS - Log downloads to console as Download for [channel/platform/filename/extension]: [asset]Detect platform via user-agent and download latest installer
/download[/channel][/prerelease]
Download latest installer for specified platform
/download[/channel][/prerelease]/:platform
Get update JSON for specified version, if version matches latest returns no content
/update[/channel][/prerelease]/:platform/:version
Get RELEASES file with nupkg download info (Windows only)
/update[/channel][/prerelease]/win32/:version/RELEASES
const { requestHandler, on } = require('oneclick-update')
const config = {
repo: 'doesdev/oneclick-release-test',
port: 8082,
token: 'yourGithubOauthToken',
serverUrl: 'https://updates.example.com',
refreshCache: '15 mins',
logDownloads: false,
platformFilters: { /* see Platforms below for details */ },
hostToChannel: {
/*
The `hostToChannel` option allows you to treat the hostname as a channel.
That means you can have `updates.example.com` handle the primary channel
and `updates.otherhost.com` handle the `otherhost` channel
*/
'updates.otherhost.com': {
name: 'otherhost',
serverUrl: 'https://updates.otherhost.com'
}
}
}
const startServer = async () => {
const handler = await requestHandler(config)
createServer(handler).listen(config.port, () => {
console.log(`Update server running on port ${config.port}`)
})
}
on('download', ({ ip, requestUrl, asset, channel, platform, version }) => {
console.log(`User at ${ip} downloaded ${asset}`)
})
startServer()
Natively supports Windows, OSX and Linux.
Currently arch specification is not fully implemented. That being said you can create your own platform extensions that filter assets as you desire. The intent is to support arch specification natively, but in the interim it could be implemented something like this (assuming you've named Windows x64 assets with win64 in the name).
const config = {
platformFilters: {
win64: (assets, action) => {
return assets.find((a) => a.name.indexOf('win64') !== -1)
}
}
}
Similarly you can define any custom platform filtering that you would like. The expectation is the key is what would be specified in the platform part of the URL and the value is a function that filters the assets to the one you would like to use.
The signature of the filtering function is (assets, action, arch, extension)
assets: Array - list of Github release assets, the name property of each is the filenameaction: String - name of current action (download or update)arch: String - this is not currently passed, once arch is implemented it will beextension: String - if extension is specified via querystring, this is it (i.e. ?filetype=dmg -> dmg)MIT © Andrew Carpenter
FAQs
Simple installer downloads and update server
We found that oneclick-update demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.