
Security News
AI Agent Lands PRs in Major OSS Projects, Targets Maintainers via Cold Outreach
An AI agent is merging PRs into major OSS projects and cold-emailing maintainers to drum up more work.
A tiny (330B to 357B) and fast utility to find a package's hidden supply / cache directory
A tiny (330B to 357B) and fast utility to find a module's hidden supply / cache directory.
With scorta, you can locate a module's private .cache directory by name.
This is a common practice among many popular libraries, including AVA, nyc, Babel, etc.
# Others
./node_modules/.cache/ava
./node_modules/.cache/babel
./node_modules/.cache/nyc
# Yours!
./node_modules/.cache/hello-world
When searching, the following steps are taken:
process.env.CACHE_DIR if defined and truthypackage.json file is foundpackage.json was found, return a node_modules/.cache/{name} path only if it's not read-onlyfallback, which is either undefined or a os.tmpdir valueWhy "scorta"? It's Italian for a stock or a supply, which is generally the purpose for a
.cachedirectory.
$ npm install --save scorta
There are two "versions" of scorta available:
Node.js: >= 8.x
Size (gzip): 357 bytes
Availability: CommonJS, ES Module
This is the primary/default mode. It makes use of async/await and util.promisify.
Node.js: >= 6.x
Size (gzip): 330 bytes
Availability: CommonJS, ES Module
This is the opt-in mode, ideal for scenarios where async usage cannot be supported.
Example Structure
/example
├── fixtures
└── empty.js
└── demo
└── node_modules/...
└── package.json
└── index.js
Example Usage
// demo/index.js
import { join } from 'path';
import { scorta } from 'scorta';
const fixtures = join(__dirname, '..', 'fixtures');
await scorta('hello');
//=> "/example/demo/node_modules/.cache/hello"
await scorta('hello', { cwd: fixtures });
//=> undefined
await scorta('hello', { cwd: fixtures, tmpdir: true });
//=> "/var/folders/77/hdmgkj_x2l7454w0y5lwv2l80000gn/T"
Note: To run the above example with "sync" mode, import from
scorta/sync& remove theawaits.
Returns: Promise<string|void> or string|void
When scorta locates a valid directory, the value will always be an absolute path (string).
However, if scorta cannot locate a valid, writable directory, then the return value is undefined by default. However, this can be changed via the tmpdir option.
Important:
Thesyncandasyncversions share the same API.
The only difference is thatsyncis not Promise-based.
Type: string
The target module's name.
This value is used to construct the final .cache directory path. For example:
await scorta('hello');
//=> /.../node_modules/.cache/hello
Type: string
Default: .
The directory where path resolution should begin.
Defauls to the process.cwd() – aka, the directory that your process is run within.
Type: boolean
Default: false
When truthy, scorta will return a os.tmpdir() value instead of undefined.
Important: When this option is in use,
scortaalways yields a string!
Running on Node.js v10.13.0
# Load Time
find-cache-dir 11.628ms
scorta 1.326ms
scorta/sync 0.508ms
# Levels: 0 (target = "foo"):
find-cache-dir x 10,700 ops/sec ±0.55% (82 runs sampled)
scorta/sync x 11,060 ops/sec ±0.83% (88 runs sampled)
scorta x 80,804 ops/sec ±2.22% (74 runs sampled)
# Levels: 6 (target = "bar"):
find-cache-dir x 2,107 ops/sec ±0.42% (89 runs sampled)
scorta/sync x 5,507 ops/sec ±0.46% (91 runs sampled)
scorta x 78,593 ops/sec ±4.03% (79 runs sampled)
# Levels: 11 (target = "baz"):
find-cache-dir x 1,377 ops/sec ±0.36% (93 runs sampled)
scorta/sync x 3,892 ops/sec ±0.25% (95 runs sampled)
scorta x 76,641 ops/sec ±6.92% (68 runs sampled)
MIT © Luke Edwards
FAQs
A tiny (330B to 357B) and fast utility to find a package's hidden supply / cache directory
The npm package scorta receives a total of 275 weekly downloads. As such, scorta popularity was classified as not popular.
We found that scorta demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
An AI agent is merging PRs into major OSS projects and cold-emailing maintainers to drum up more work.

Research
/Security News
Chrome extension CL Suite by @CLMasters neutralizes 2FA for Facebook and Meta Business accounts while exfiltrating Business Manager contact and analytics data.

Security News
After Matplotlib rejected an AI-written PR, the agent fired back with a blog post, igniting debate over AI contributions and maintainer burden.