
Security News
minimatch Patches 3 High-Severity ReDoS Vulnerabilities
minimatch patched three high-severity ReDoS vulnerabilities that can stall the Node.js event loop, and Socket has released free certified patches.
read-package-up
Advanced tools
Read the closest package.json file
npm install read-package-up
import {readPackageUp} from 'read-package-up';
console.log(await readPackageUp());
/*
{
packageJson: {
name: 'awesome-package',
version: '1.0.0',
…
},
path: '/Users/sindresorhus/dev/awesome-package/package.json'
}
*/
Returns a Promise<object>, or Promise<undefined> if no package.json was found.
Returns the result object, or undefined if no package.json was found.
Type: object
Type: URL | string
Default: process.cwd()
The directory to start looking for a package.json file.
Type: boolean
Default: true
Normalize the package data.
The 'find-up' package is a utility for finding a file or directory by walking up parent directories. It is more general-purpose compared to 'read-package-up' as it can be used to find any file, not just package.json. However, it requires additional steps to read and parse the package.json file.
The 'pkg-up' package is similar to 'read-package-up' in that it finds the closest package.json file by traversing upwards. However, it only returns the path to the package.json file and does not read its contents. You would need to use another package like 'fs' to read the file.
The 'read-pkg' package reads the package.json file from a specified path. Unlike 'read-package-up', it does not traverse upwards to find the closest package.json file. It is useful when you already know the exact path to the package.json file you want to read.
FAQs
Read the closest package.json file
The npm package read-package-up receives a total of 4,144,723 weekly downloads. As such, read-package-up popularity was classified as popular.
We found that read-package-up demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
minimatch patched three high-severity ReDoS vulnerabilities that can stall the Node.js event loop, and Socket has released free certified patches.

Research
/Security News
Socket uncovered 26 malicious npm packages tied to North Korea's Contagious Interview campaign, retrieving a live 9-module infostealer and RAT from the adversary's C2.

Research
An impersonated golang.org/x/crypto clone exfiltrates passwords, executes a remote shell stager, and delivers a Rekoobe backdoor on Linux.