Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Turn a string of command line options into an array for child_process.spawn
The spawn-args npm package is used to parse command-line arguments into an array that can be passed to child_process.spawn in Node.js. This is particularly useful for executing shell commands programmatically.
Basic Argument Parsing
This feature allows you to parse a command-line string into an array of arguments. This array can then be used with child_process.spawn to execute the command.
const spawnArgs = require('spawn-args');
const args = spawnArgs('ls -la /usr/local');
console.log(args); // Output: ['ls', '-la', '/usr/local']
Handling Quoted Strings
This feature handles quoted strings correctly, ensuring that arguments containing spaces are treated as a single argument.
const spawnArgs = require('spawn-args');
const args = spawnArgs('echo "Hello World"');
console.log(args); // Output: ['echo', 'Hello World']
Custom Delimiters
This feature allows you to specify a custom delimiter for separating arguments, which can be useful for parsing non-standard command-line formats.
const spawnArgs = require('spawn-args');
const args = spawnArgs('command arg1,arg2,arg3', { delimiter: ',' });
console.log(args); // Output: ['command', 'arg1', 'arg2', 'arg3']
yargs-parser is a powerful library for parsing command-line arguments. It offers more advanced features like argument type coercion, default values, and aliases. Compared to spawn-args, yargs-parser is more feature-rich but also more complex.
minimist is a lightweight library for parsing command-line arguments. It is simpler and more lightweight compared to yargs-parser and spawn-args, making it suitable for basic use cases where advanced features are not required.
commander is a comprehensive solution for building command-line interfaces. It includes argument parsing as well as features for defining commands, options, and subcommands. It is more feature-rich than spawn-args but also more complex to set up.
Turn a string of command line options into an array for child_process.spawn
$ npm install spawn-args
var spawnargs = require('spawn-args');
//spawnargs(argString:string[, options:object]);
var args = spawnargs('-port 80 --title "this is a title"');
/*
[
'-port',
'80',
'--title',
'"this is a title"'
]
*/
The removequotes
option will remove quotes from values if they do not have spaces
var args2 = spawnargs('-port 80 --color "red" --title "this is a title"', { removequotes: true });
/*
[
'-port',
'80',
'--title',
'"this is a title"'
]
*/
If removequotes
is always
then quotes will be removed even if the value contains spaces
var args3 = spawnargs('-port 80 --color "red" --title "this is a title"', { removequotes: 'always' });
/*
[
'-port',
'80',
'--title',
'this is a title'
]
*/
MIT
FAQs
Turn a string of command line options into an array for child_process.spawn
The npm package spawn-args receives a total of 124,496 weekly downloads. As such, spawn-args popularity was classified as popular.
We found that spawn-args demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.