
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
This module provides a subset of functionality of gulp.src with basically the same output format (stream of Vinyl files). As its name implies, it may be useful when standard gulp.src is too slow, especially when dealing with huge directory trees with complex glob negations.
Arguably the most useful feature of this module is the ability to asynchronously check whether there is a need to recurse further into a directory subtree, based on both input and planned output paths.
The only exported function of the module has the following parameters:
Required. Should be a path to directory where files are to be streamed from.
Optional. By default, all files from basePath will be streamed. This parameter is one of two ways to filter the stream. As specified in the usage example below, it should be an object tree of arbitrary depth, specifying paths which should be excluded from the resulting stream. Each key starting with / specifies a filename (as in "everything is a file") at specific directory level (/ prefix is omitted during matching). If multiple keys match a filename, the longest key wins (similar to how Nginx configuration works). When a filename key matches, 3 things can happen depending on key value:
Following are the supported non-file keys (not starting with /):
Optional. Planned target directory. This directory should not exist and will never be touched. It is only used to calculate targetPath value for CHECK_CONTINUE callback (possible part of 2nd parameter described above).
Optional. Similar to exceptionsSpec above, but should be a shallow tree, applied at each level. Most useful to exclude all files by extension or similar path pattern.
const path = require("path");
const fs = require("fs");
const Promise = require("bluebird");
const quickSrc = require("quick-src");
const fsa = Promise.promisifyAll(fs);
const gulp = require('gulp');
let excludeSpecs = {
"/build*": true,
"/logs": true,
"/bin": true,
"/test": true,
"/node_modules": {
"_CHECK_CONTINUE": nodeModuleCopyNeeded, // please check each file/directory under node_modules
"/jsreport": true,
"/vinyl*": true,
"/watchify": true,
"/api-*": {
"/node_modules": true,
"/typings": true,
"/test": true,
"/bin": true
}
}
};
let globalExcludeSpecs = {
"/test.txt": true,
"/*.log": true,
"/important.log": false // overriding shorter key to include the file
};
quickSrc("/src/path", excludeSpecs, "/dest/path", globalExcludeSpecs).pipe(gulp.dest("/dest/path"));
function nodeModuleCopyNeeded(sourcePath, targetPath) {
// if node module exists in target directory, is public and version hasn't changed, ignore it
return Promise.join(
readPackageDescription(sourcePath),
readPackageDescription(targetPath),
(s, t) => {
if (s && t && !s.private && s.version === t.version) {
return false;
}
return true;
});
}
function readPackageDescription(folderPath) {
let packagePath = path.join(folderPath, "package.json");
return fsa.readFileAsync(packagePath).then(JSON.parse).catch((err) => {
if (err.code !== 'ENOENT') {
throw err;
}
});
}
FAQs
A better performing subset of gulp src
We found that quick-src demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.