Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
update-electron-app
Advanced tools
A drop-in module that adds autoUpdating capabilities to Electron apps
A drop-in module that adds autoUpdating capabilities to Electron apps
Supports multiple update sources:
Before using this module, make sure your Electron app meets these criteria:
update.electronjs.org
@electron-forge/publisher-s3
npm i update-electron-app
update.electronjs.org
Drop this anywhere in your main process:
const { updateElectronApp } = require('update-electron-app')
updateElectronApp()
By default your repository URL is found in your app's package.json
file.
You can also specify custom options:
const { updateElectronApp, UpdateSourceType } = require('update-electron-app')
updateElectronApp({
updateSource: {
type: UpdateSourceType.ElectronPublicUpdateService,
repo: 'github-user/repo'
},
updateInterval: '1 hour',
logger: require('electron-log')
})
const { updateElectronApp, UpdateSourceType } = require('update-electron-app')
updateElectronApp({
updateSource: {
type: UpdateSourceType.StaticStorage,
baseUrl: `https://my-bucket.s3.amazonaws.com/my-app-updates/${process.platform}/${process.arch}`
}
})
Once you've called updateElectronApp
as documented above, that's it! Here's what happens by default:
ready
event; the module figures that out.update(options)
Additional Options:
updateInterval
String (optional) - How frequently to check for updates. Defaults to 10 minutes
. Minimum allowed interval is 5 minutes
. This is a human readable interval supported by the ms
modulelogger
Object (optional) - A custom logger object that defines a log
function. Defaults to console
. See electron-log, a module that aggregates logs from main and renderer processes into a single file.notifyUser
Boolean (optional) - Defaults to true
. When enabled the user will be
prompted to apply the update immediately after download.For macOS, you'll need to build a .zip
file.
Use electron-forge or electron-installer-zip to package your app as a zip.
For Windows, you'll need to build a .exe
and .nupkg
files with electron-forge or electron-winstaller.
Windows apps have an update process that requires multiple application restarts. You can use the electron-squirrel-startup module to improve this behavior.
Yes :)
If you publish your builds manually ensure the file structure is:
**/{platform}/{arch}/{artifact}
For example that means that these files should exist:
**/win32/x64/RELEASES
**/darwin/arm64/RELEASES.json
**/darwin/arm64/My App v1.0.0.zip
(or something similar)MIT
FAQs
A drop-in module that adds autoUpdating capabilities to Electron apps
We found that update-electron-app demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.