Security News
JSR Working Group Kicks Off with Ambitious Roadmap and Plans for Open Governance
At its inaugural meeting, the JSR Working Group outlined plans for an open governance model and a roadmap to enhance JavaScript package management.
package-json
Advanced tools
The package-json npm package is used to fetch metadata about a package from the npm registry without needing to download the entire package. It can be used to get the latest version of a package, its dependencies, versions, and other useful metadata.
Get the latest version of a package
Fetches the latest version of the specified package from the npm registry.
{"packageJson": require('package-json'), "getLatestPackageVersion": async function(packageName) { const packageData = await packageJson(packageName); return packageData.version; }}
Get metadata for a specific version of a package
Retrieves metadata for a specific version of a package, including dependencies, repository information, and more.
{"packageJson": require('package-json'), "getPackageDataForVersion": async function(packageName, version) { const packageData = await packageJson(packageName, {version: version}); return packageData; }}
Get all versions of a package
Fetches a list of all available versions of a package from the npm registry.
{"packageJson": require('package-json'), "getAllVersions": async function(packageName) { const packageData = await packageJson(packageName, {allVersions: true}); return Object.keys(packageData.versions); }}
Get the full metadata of a package
Retrieves the full metadata of a package, which includes additional information that's not part of the default output, such as deprecated versions and peerDependencies.
{"packageJson": require('package-json'), "getFullMetadata": async function(packageName) { const packageData = await packageJson(packageName, {fullMetadata: true}); return packageData; }}
Similar to package-json, npm-registry-fetch is used to make requests to the npm registry. It provides more control over the HTTP requests, such as custom headers, but it's lower-level and requires more setup compared to package-json.
Pacote is a library that can fetch metadata and tarballs from npm. It's more feature-rich than package-json, offering manifest fetching, tarball extraction, and more. It's also used internally by npm CLI.
While not directly similar, registry-auth-token is often used in conjunction with packages like package-json to handle private packages that require authentication. It retrieves the auth token for the npm registry from the user's .npmrc file.
Get the package.json of a package from the npm registry
$ npm install --save package-json
var packageJson = require('package-json');
packageJson('pageres', 'latest', function (err, json) {
console.log(json);
//=> { name: 'pageres', ... }
});
// also works with scoped packages
packageJson('@company/package', 'latest', function (err, json) {
console.log(json);
//=> { name: 'package', ... }
});
packageJson.field('pageres', 'description', function (err, field) {
console.log(field);
//=> 'Capture website screenshots'
});
You can optionally specify a version (e.g. 0.1.0
) or latest
.
If you don't specify a version you'll get the main entry containing all versions.
Get a specific field in the package.json
.
MIT © Sindre Sorhus
FAQs
Get metadata of a package from the npm registry
The npm package package-json receives a total of 6,300,240 weekly downloads. As such, package-json popularity was classified as popular.
We found that package-json demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
At its inaugural meeting, the JSR Working Group outlined plans for an open governance model and a roadmap to enhance JavaScript package management.
Security News
Research
An advanced npm supply chain attack is leveraging Ethereum smart contracts for decentralized, persistent malware control, evading traditional defenses.
Security News
Research
Attackers are impersonating Sindre Sorhus on npm with a fake 'chalk-node' package containing a malicious backdoor to compromise developers' projects.