Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
The 'read' npm package is a simple utility for reading user input from the command line. It is often used to prompt users for information in a synchronous manner, making it useful for command-line applications and scripts.
Basic User Input
This feature allows you to prompt the user for input and handle the response. The example code asks the user for their name and then prints a greeting.
const read = require('read');
const options = {
prompt: 'What is your name? '
};
read(options, function(err, result) {
if (err) {
console.error('Error:', err);
} else {
console.log('Hello, ' + result + '!');
}
});
Password Input
This feature allows you to prompt the user for sensitive information like passwords without displaying the input on the screen. The example code asks the user for a password and confirms receipt without showing the password.
const read = require('read');
const options = {
prompt: 'Enter your password: ',
silent: true
};
read(options, function(err, result) {
if (err) {
console.error('Error:', err);
} else {
console.log('Password received.');
}
});
Default Values
This feature allows you to provide a default value for the user input. The example code asks the user for their favorite color and defaults to 'blue' if no input is provided.
const read = require('read');
const options = {
prompt: 'What is your favorite color? ',
default: 'blue'
};
read(options, function(err, result) {
if (err) {
console.error('Error:', err);
} else {
console.log('Your favorite color is ' + result + '.');
}
});
The 'prompt' package is a more feature-rich alternative to 'read'. It supports validation, default values, and complex prompts with multiple fields. It is more suitable for applications that require more sophisticated user input handling.
The 'inquirer' package is another alternative that provides a more interactive experience. It supports various types of prompts like lists, checkboxes, and password fields. It is ideal for building interactive command-line interfaces.
The 'readline-sync' package allows for synchronous reading of user input from the command line. It is similar to 'read' but provides more control over the input process, including the ability to handle multiple lines of input.
For reading user input from stdin.
Similar to the readline
builtin's question()
method, but with a
few more features.
const { read } = require('read')
// or with ESM: import { read } from 'read'
try {
const result = await read(options)
} catch (er) {
console.error(er)
}
Every option is optional.
prompt
What to write to stdout before reading input.silent
Don't echo the output as the user types it.replace
Replace silenced characters with the supplied character value.timeout
Number of ms to wait for user input before giving up.default
The default value if the user enters nothing.edit
Allow the user to edit the default value.terminal
Treat the output as a TTY, whether it is or not.input
Readable stream to get input data from. (default process.stdin
)output
Writable stream to write prompts to. (default: process.stdout
)completer
Autocomplete callback (see official api for detailsIf silent is true, and the input is a TTY, then read will set raw mode, and read character by character.
Patches welcome.
4.0.0 (2024-09-25)
read
now supports node ^18.17.0 || >=20.5.0
1b07665
#109 bump c8 from 8.0.1 to 10.1.2 (#109) (@dependabot[bot])cdf4cd8
#122 bump @npmcli/eslint-config from 4.0.5 to 5.0.0 (#122) (@dependabot[bot])104dc92
#116 bump tshy from 1.18.0 to 3.0.2 (#116) (@dependabot[bot])8f24ce4
#124 run template-oss-apply (@hashtagchris)8a7ba09
#120 bump @typescript-eslint/parser from 7.18.0 to 8.0.1 (#120) (@dependabot[bot])d6beca8
#103 bump @npmcli/template-oss to 4.22.0 (@lukekarrys)ff55321
#100 bump @typescript-eslint/parser from 6.21.0 to 7.2.0 (#100) (@dependabot[bot])d30350d
#123 postinstall for dependabot template-oss PR (@hashtagchris)8558668
#123 bump @npmcli/template-oss from 4.23.1 to 4.23.3 (@dependabot[bot])FAQs
read(1) for node programs
We found that read demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.