
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
Takes a root dir and recursively streams paths.
var recurse = require('recurse');
// recursively write all filetypes except directories:
recurse('.').pipe(process.stdout);
// recursively write js files:
function js(relname, stat) {
return !stat.isDirectory() && relname.match(/\.js$/)
}
recurse('.', {writefilter: js}).pipe(process.stdout);
// recursively write dirs:
function dir(relname, stat) {
return stat.isDirectory();
}
recurse('.', {writefilter: dir}).pipe(process.stdout);
// non-recursively write all files:
function none(relname, stat) {
return false;
}
recurse('.', {recursefilter: none}).pipe(process.stdout);
// recurse into test/ and write js files:
function test(relname, stat) {
return stat.isDirectory() && ~relname.indexOf('test');
}
recurse('.', {recursefilter: test, writefilter: js}).pipe(process.stdout);
var recurse = require('recurse');
Return a redable stream of all paths beneath a root directory.
Optionally pass in the following opts:
opts.writefilter - custom function for determining whether to write a
path to the recurse stream using a opts.writefilter(relname, stat)
signature.opts.recursefilter - custom function for determining whether to recurse a
path using a opts.writefilter(relname, stat) signature.opts.resolvesymlinks - if set to true symbolic links will be resolvedNode 0.8.x will use the readable-stream module while node 0.10.x and newer
will use the core Readable stream class.
recurse is about an order of magnitude slower than GNU find
after a couple of runs on my home directory. See the benchmark
for detailed results against other node modules.
MIT
FAQs
Takes a root dir and recursively streams paths
We found that recurse demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.