
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
windows-release
Advanced tools
Get the name of a Windows version from the release number: `5.1.2600` → `XP`
Get the name of a Windows version from the release number:
5.1.2600→XP
npm install windows-release
import os from 'node:os';
import windowsRelease from 'windows-release';
// On a Windows XP system
windowsRelease();
//=> 'XP'
os.release();
//=> '5.1.2600'
windowsRelease(os.release());
//=> 'XP'
windowsRelease('4.90.3000');
//=> 'ME'
Returns: string | undefined
Returns the Windows version name, or undefined if the version is not recognized or does not exist.
Type: string
By default, the current OS is used, but you can supply a custom release number, which is the output of os.release().
Note: Most Windows Server versions cannot be detected based on the release number alone. There is runtime detection in place to work around this, but it will only be used if no argument is supplied, or the supplied argument matches os.release().
The os-name package provides a more general solution for getting the name of the operating system, including Windows, macOS, and Linux. It offers broader functionality compared to windows-release, which is specific to Windows.
The os-release package is another alternative that provides information about the operating system release. It is more focused on Linux distributions but can be used in conjunction with other tools to get similar information for Windows.
FAQs
Get the name of a Windows version from the release number: `5.1.2600` → `XP`
The npm package windows-release receives a total of 2,748,939 weekly downloads. As such, windows-release popularity was classified as popular.
We found that windows-release demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.