
Security News
CVE Volume Surges Past 48,000 in 2025 as WordPress Plugin Ecosystem Drives Growth
CVE disclosures hit a record 48,185 in 2025, driven largely by vulnerabilities in third-party WordPress plugins.
A tiny (330B to 357B) and fast utility to find a package's hidden supply / cache directory
A tiny (330B to 357B) and fast utility to find a module's hidden supply / cache directory.
With scorta, you can locate a module's private .cache directory by name.
This is a common practice among many popular libraries, including AVA, nyc, Babel, etc.
# Others
./node_modules/.cache/ava
./node_modules/.cache/babel
./node_modules/.cache/nyc
# Yours!
./node_modules/.cache/hello-world
When searching, the following steps are taken:
process.env.CACHE_DIR if defined and truthypackage.json file is foundpackage.json was found, return a node_modules/.cache/{name} path only if it's not read-onlyfallback, which is either undefined or a os.tmpdir valueWhy "scorta"? It's Italian for a stock or a supply, which is generally the purpose for a
.cachedirectory.
$ npm install --save scorta
There are two "versions" of scorta available:
Node.js: >= 8.x
Size (gzip): 357 bytes
Availability: CommonJS, ES Module
This is the primary/default mode. It makes use of async/await and util.promisify.
Node.js: >= 6.x
Size (gzip): 330 bytes
Availability: CommonJS, ES Module
This is the opt-in mode, ideal for scenarios where async usage cannot be supported.
Example Structure
/example
├── fixtures
└── empty.js
└── demo
└── node_modules/...
└── package.json
└── index.js
Example Usage
// demo/index.js
import { join } from 'path';
import { scorta } from 'scorta';
const fixtures = join(__dirname, '..', 'fixtures');
await scorta('hello');
//=> "/example/demo/node_modules/.cache/hello"
await scorta('hello', { cwd: fixtures });
//=> undefined
await scorta('hello', { cwd: fixtures, tmpdir: true });
//=> "/var/folders/77/hdmgkj_x2l7454w0y5lwv2l80000gn/T"
Note: To run the above example with "sync" mode, import from
scorta/sync& remove theawaits.
Returns: Promise<string|void> or string|void
When scorta locates a valid directory, the value will always be an absolute path (string).
However, if scorta cannot locate a valid, writable directory, then the return value is undefined by default. However, this can be changed via the tmpdir option.
Important:
Thesyncandasyncversions share the same API.
The only difference is thatsyncis not Promise-based.
Type: string
The target module's name.
This value is used to construct the final .cache directory path. For example:
await scorta('hello');
//=> /.../node_modules/.cache/hello
Type: string
Default: .
The directory where path resolution should begin.
Defauls to the process.cwd() – aka, the directory that your process is run within.
Type: boolean
Default: false
When truthy, scorta will return a os.tmpdir() value instead of undefined.
Important: When this option is in use,
scortaalways yields a string!
Running on Node.js v10.13.0
# Load Time
find-cache-dir 11.628ms
scorta 1.326ms
scorta/sync 0.508ms
# Levels: 0 (target = "foo"):
find-cache-dir x 10,700 ops/sec ±0.55% (82 runs sampled)
scorta/sync x 11,060 ops/sec ±0.83% (88 runs sampled)
scorta x 80,804 ops/sec ±2.22% (74 runs sampled)
# Levels: 6 (target = "bar"):
find-cache-dir x 2,107 ops/sec ±0.42% (89 runs sampled)
scorta/sync x 5,507 ops/sec ±0.46% (91 runs sampled)
scorta x 78,593 ops/sec ±4.03% (79 runs sampled)
# Levels: 11 (target = "baz"):
find-cache-dir x 1,377 ops/sec ±0.36% (93 runs sampled)
scorta/sync x 3,892 ops/sec ±0.25% (95 runs sampled)
scorta x 76,641 ops/sec ±6.92% (68 runs sampled)
MIT © Luke Edwards
FAQs
A tiny (330B to 357B) and fast utility to find a package's hidden supply / cache directory
We found that scorta demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
CVE disclosures hit a record 48,185 in 2025, driven largely by vulnerabilities in third-party WordPress plugins.

Security News
Socket CEO Feross Aboukhadijeh joins Insecure Agents to discuss CVE remediation and why supply chain attacks require a different security approach.

Security News
Tailwind Labs laid off 75% of its engineering team after revenue dropped 80%, as LLMs redirect traffic away from documentation where developers discover paid products.