
Security News
CVE Volume Surges Past 48,000 in 2025 as WordPress Plugin Ecosystem Drives Growth
CVE disclosures hit a record 48,185 in 2025, driven largely by vulnerabilities in third-party WordPress plugins.
Fast, non-blocking rm -rf alternative. Deletes files instantly while cleanup runs in the background.
Ever rm -rf'd a large directory and sat there waiting for it to finish? With poof you no longer need to wait:
$ poof ./large-file ./large-directory "**/globs"
poof is a fast, non-blocking CLI alternative to rm -rf, designed for deleting large files and directories without waiting for cleanup to complete.
It works by quickly moving files and directories out of the way, then deleting them in the background. This means large deletions finish instantly from your perspective, even when there's a lot of data to clean up.
On a large filesystem (4.7 GB, 190k files), poof returns control in ~0.6s while rm -rf takes ~28s and rimraf ~12s. Full benchmarks below.
npm install -g poof
# Delete files or directories
$ poof node_modules dist
# Use glob patterns
$ poof "*.log" "temp-*"
# Recursive match with ** (searches all subdirectories)
$ poof "**/node_modules" "**/dist"
# Verbose output
$ poof --verbose ./large-directory
| Flag | Alias | Description |
|---|---|---|
--dry | -d | Preview files without deleting |
--verbose | -v | Log each file as it's deleted |
--ignore | -i | Glob pattern to exclude from deletion |
--dangerous | Allow deleting paths outside current directory | |
--version | Show version | |
--help | Show help |
poof accepts explicit paths or glob patterns for flexible file matching.
[!TIP] When using glob patterns, start with
--dryto preview what will match before deleting.
How unquoted glob patterns are expanded depends on your shell's settings (dotglob, globstar, etc.).
To get consistent behavior, quote the pattern so poof handles the matching itself.
# The shell expands the glob before poof runs
$ poof **/node_modules
# Recommended: poof expands the glob
$ poof "**/node_modules"
# Explicit paths
$ poof node_modules
# Multiple paths
$ poof dist coverage
# Wildcards in current directory
$ poof "*.log"
$ poof "temp-*"
Use ** to match across nested directories:
# All node_modules in a monorepo
$ poof "**/node_modules"
# All .log files recursively
$ poof "**/*.log"
# Multiple patterns
$ poof "**/dist" "**/coverage" "**/*.tmp"
Use --ignore to exclude paths from deletion:
# Delete all dist folders except those in node_modules
$ poof "**/dist" --ignore "**/node_modules/**"
# Multiple ignore patterns
$ poof "**/*.log" -i "**/important/**" -i "**/backup/**"
By default, glob wildcards (*, **) don't match dotfiles (files starting with .). This helps avoid accidentally deleting .git, .env, or other hidden files.
To target dotfiles, explicitly include the . in your pattern:
# Delete all dotfiles in current directory
$ poof ".*"
# Delete .cache directories (not inside hidden dirs)
$ poof "**/.cache"
# Delete a specific dotfile
$ poof .env.local
**/.cache finds .cache directories in regular directories, but does not scan inside other hidden directories like .git. This is intentional—scanning hidden directories is slow and rarely useful.
To search inside hidden directories, start your pattern with .*:
# Find .cache inside any hidden directory
$ poof ".*/**/.cache"
Or use brace expansion to target specific directories:
# Search inside .config and src
$ poof "{.config,src}/**/.cache"
Extglob negations like !(pattern) match everything except the specified pattern:
# Delete everything except .gitkeep
$ poof "!(.gitkeep)"
[!WARNING] Negations match dotfiles.
!(important.txt)will match.env,.git, and other hidden files. Always use--dryfirst.
poof includes guards to help prevent common accidents:
cwd unless --dangerous is passedpoof ndoe_modoules won't silently succeedpoof "*.log" won't break your scriptsTraditional rm -rf blocks until every file is unlinked.
For large directories, this means waiting on thousands of filesystem operations.
poof uses a different strategy:
If the target is on a different filesystem (EXDEV), poof falls back to renaming in place with a hidden prefix (e.g., .poof-uuid-large-directory) and streams it directly to the cleaner.
Deleting **/node_modules directories from a synthetic fixture:
| Tool | Time | vs poof |
|---|---|---|
poof | 0.59s | — |
rimraf | 12.32s | 21x slower |
rm -rf | 27.82s | 48x slower |
Fixture: 4.7 GB, 190k files
Environment: macOS 15.2, Apple M2 Max, SSD
[!NOTE] These benchmarks measure how long it takes to return control of your terminal, not actual deletion time. Background deletion continues after
poofexits.rm -rfandrimrafmeasure actual deletion time.
poof can also be used programmatically:
import poof from 'poof'
await poof('./large-directory')
await poof(['**/dist', 'coverage'])
const { deleted, errors } = await poof('./large-directory', { dry: true })
type Options = {
cwd?: string
dry?: boolean
dangerous?: boolean
ignore?: string[]
}
type Failure = {
path: string
error: Error
}
type Result = {
deleted: string[]
errors: Failure[]
}
Some tools provide fast, non-blocking removal by moving files to the system trash:
These are useful for recoverable deletes, but large directories can accumulate in the trash and consume disk space.
poof permanently deletes files, freeing space immediately.
Node.js >= 20.19.6
MIT
FAQs
Fast, non-blocking rm -rf alternative. Deletes files instantly while cleanup runs in the background.
We found that poof demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
CVE disclosures hit a record 48,185 in 2025, driven largely by vulnerabilities in third-party WordPress plugins.

Security News
Socket CEO Feross Aboukhadijeh joins Insecure Agents to discuss CVE remediation and why supply chain attacks require a different security approach.

Security News
Tailwind Labs laid off 75% of its engineering team after revenue dropped 80%, as LLMs redirect traffic away from documentation where developers discover paid products.