
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
read-workspaces
Advanced tools
Resolves all package.json files of a workspace setup.
Supports both npm / yarn style workspace definitions and pnpm style.
import { readWorkspaces } from 'read-workspaces';
for await (const { cwd, pkg, workspace } = readWorkspaces()) {
// ...
}
readWorkspaces([options])options.cwd='.': A string pointing to the path of the module to look up the package.json and installed modules foroptions.ignorePaths: An array of strings, string[], with paths to ignore during the lookup of workspacesoptions.includeWorkspaceRoot=true: When set to false the workspace root will not be returned. Equivalent to npm --include-workspace-root but with different default.options.skipWorkspaces: When set to true, no workspace lookup will occur. Equivalent to npm --workspaces but with different default.options.workspace: An array of strings, string[], that should either match the name of a workspace or its path / path prefix. Narrows returned workspaces to those matching the provided strings. If a requested workspace can't be found, then an error will be thrown when the generator completes. Equivalent to npm's npm --workspace / npm -w.AsyncGenerator that yields the workspace root initially (unless its excluded) and then each matching workspaces
cwd: the string path to the workspace / rootpkg: the package.json content of the workspace / rootworkspace: the string name of the workspace (not set on the root)read-pkg – similar functionality but reads a single packageFAQs
Read all package.json files in a workspace
The npm package read-workspaces receives a total of 8,236 weekly downloads. As such, read-workspaces popularity was classified as popular.
We found that read-workspaces demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.