
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
a CLI that crawls given directories and files, discovers both local images and remote image URLs, and reports their metadata—file size, dimensions, and status—in a sortable table with configurable concurrency, timeouts, and ignore rules.
A CLI tool that scans source files for image references (remote URLs or local paths), inspects each asset, and reports the size and resolution.
.git and node_modules by default, configurable via --ignore).fetch).node-fetch and adjust the script if necessary.npm install scanimg -g
npx scanimg --dir ./src --dir ./docs
# exclude build output
npx scanimg --dir . --ignore dist --ignore coverage
If --dir is omitted, the current directory is scanned.
| Option | Default | Description |
|---|---|---|
--dir <path> | . | Directory or file to scan; may be repeated. |
--timeout <ms> | 10000 | Request timeout in milliseconds (remote only). |
--concurrency <n> | 5 | Maximum number of concurrent inspections. |
--ignore <name> | ['.git', 'node_modules'] | Directory name to ignore during traversal (match by folder name); may be repeated. |
--help, -h | - | Show usage information. |
Inspecting 12 images...
Index | Target | Type | Size | Resolution | Status | Occurrences
----- | ------------------------------------------- | ------ | -------- | ---------- | ---------------------------- | -----------
1 | https://example.com/assets/banner@2x.png | Remote | 1.54 MB | 1440x900 | OK(HEAD); OK(Range) | 3
2 | public/images/logo.svg | Local | 17.20 KB | 320x80 | OK(file) | 4
3 | https://cdn.example.com/pic/avatar.webp | Remote | 243.87 KB| 512x512 | OK(HEAD); OK(Range) | 2
Done.
content-length or range requests, the size may appear as -; consult the Status column for clues.--ignore to skip build artifacts or backup folders so unrelated images stay out of the report.MIT
FAQs
a CLI that crawls given directories and files, discovers both local images and remote image URLs, and reports their metadata—file size, dimensions, and status—in a sortable table with configurable concurrency, timeouts, and ignore rules.
We found that scanimg demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.