
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
The 'read' npm package is a simple utility for reading user input from the command line. It is often used to prompt users for information in a synchronous manner, making it useful for command-line applications and scripts.
Basic User Input
This feature allows you to prompt the user for input and handle the response. The example code asks the user for their name and then prints a greeting.
const read = require('read');
const options = {
prompt: 'What is your name? '
};
read(options, function(err, result) {
if (err) {
console.error('Error:', err);
} else {
console.log('Hello, ' + result + '!');
}
});
Password Input
This feature allows you to prompt the user for sensitive information like passwords without displaying the input on the screen. The example code asks the user for a password and confirms receipt without showing the password.
const read = require('read');
const options = {
prompt: 'Enter your password: ',
silent: true
};
read(options, function(err, result) {
if (err) {
console.error('Error:', err);
} else {
console.log('Password received.');
}
});
Default Values
This feature allows you to provide a default value for the user input. The example code asks the user for their favorite color and defaults to 'blue' if no input is provided.
const read = require('read');
const options = {
prompt: 'What is your favorite color? ',
default: 'blue'
};
read(options, function(err, result) {
if (err) {
console.error('Error:', err);
} else {
console.log('Your favorite color is ' + result + '.');
}
});
The 'prompt' package is a more feature-rich alternative to 'read'. It supports validation, default values, and complex prompts with multiple fields. It is more suitable for applications that require more sophisticated user input handling.
The 'inquirer' package is another alternative that provides a more interactive experience. It supports various types of prompts like lists, checkboxes, and password fields. It is ideal for building interactive command-line interfaces.
The 'readline-sync' package allows for synchronous reading of user input from the command line. It is similar to 'read' but provides more control over the input process, including the ability to handle multiple lines of input.
For reading user input from stdin.
Similar to the readline
builtin's question()
method, but with a
few more features.
const { read } = require('read')
// or with ESM: import { read } from 'read'
try {
const result = await read(options)
} catch (er) {
console.error(er)
}
Every option is optional.
prompt
What to write to stdout before reading input.silent
Don't echo the output as the user types it.replace
Replace silenced characters with the supplied character value.timeout
Number of ms to wait for user input before giving up.default
The default value if the user enters nothing.edit
Allow the user to edit the default value.terminal
Treat the output as a TTY, whether it is or not.input
Readable stream to get input data from. (default process.stdin
)output
Writable stream to write prompts to. (default: process.stdout
)completer
Autocomplete callback (see official api for detailshistory
History array, which will be appended to.If silent is true, and the input is a TTY, then read will set raw mode, and read character by character.
Patches welcome.
FAQs
read(1) for node programs
The npm package read receives a total of 4,596,133 weekly downloads. As such, read popularity was classified as popular.
We found that read demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.