
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A warning system for peer dependencies.
peerDependencies may become removed from npm but that doesn't mean modules won't have peer dependencies. Any time a module accepts a plugin a peer dependency has been created. This library will help you warn users when they have not installed a compatible peer dependency.
Install with npm install peerdep --save and then in your module/plugin's package.json, define your peerDependencies as normal but include this peerdep install script:
{
"name": "my-plugin",
"version": "0.1.0",
"scripts": {
"install": "peerdep"
},
"peerDependencies": {
"grunt": "~0.4.1"
},
"dependencies": {
"peerdep": "~0.1.0"
}
}
Now when your plugin has been installed it will run the peerdep script to check if a compatible version of grunt@~0.4.1 has been installed. If it has not been installed or an incompatible version has been installed peerdep will log a warning to the user upon npm install:
WARN peerinvalid Peer my-plugin@0.1.0 wants grunt@~0.4.1 but found "grunt@0.3.0" installed.
peerDependencies keyThe first argument of the peerdep script is an alternate key if you want to avoid conflicts with the existing peerDependencies key:
{
"name": "my-plugin",
"version": "0.1.0",
"scripts": {
"install": "peerdep myPeerDependencies"
},
"myPeerDependencies": {
"grunt": "~0.4.1"
},
"dependencies": {
"peerdep": "~0.1.0"
}
}
Copyright (c) 2014 Kyle Robinson Young
Licensed under the MIT license.
FAQs
An alternative peer dependency warning system
We found that peerdep demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.