Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
write-file-atomic
Advanced tools
The write-file-atomic npm package is designed to write files to disk atomically, meaning that it ensures that the file contents are either fully written or not written at all, preventing partial writes that can occur in crash scenarios. It also allows for setting file mode and ownership atomically with the file write.
Atomic file writing
This feature ensures that the file is either completely written or not written at all, which is useful for preventing data corruption during write operations.
const writeFileAtomic = require('write-file-atomic');
writeFileAtomic('message.txt', 'Hello, World!', function (err) {
if (err) throw err;
console.log('The file has been saved!');
});
Setting file mode
This feature allows the user to set the file mode (permissions) at the time of writing the file atomically.
const writeFileAtomic = require('write-file-atomic');
writeFileAtomic('message.txt', 'Hello, World!', { mode: 0o755 }, function (err) {
if (err) throw err;
console.log('The file has been saved with the specified mode!');
});
Setting file ownership
This feature allows the user to set the file ownership (user ID and group ID) atomically with the file write operation.
const writeFileAtomic = require('write-file-atomic');
writeFileAtomic('message.txt', 'Hello, World!', { chown: { uid: 1000, gid: 50 } }, function (err) {
if (err) throw err;
console.log('The file has been saved with the specified ownership!');
});
fs-extra is a package that builds on the native fs module, providing additional methods and ensuring compatibility across different platforms. It includes methods for atomic file writing, but also offers a wide range of other file system operations, making it more extensive than write-file-atomic.
graceful-fs is a drop-in replacement for the fs module that makes file system operations more robust by queuing them and retrying on failure. It does not specifically focus on atomic writes, but it enhances the overall reliability of file system interactions.
atomic-write is a minimalistic module that provides atomic file writing capabilities. It is similar to write-file-atomic but with a smaller feature set and API surface area, focusing solely on the atomicity of the write operation.
This is an extension for node's fs.writeFile
that makes its operation
atomic and allows you set ownership (uid/gid of the file).
writeFileAtomic(filename, data, [options], [callback])
Atomically and asynchronously writes data to a file, replacing the file if it already exists. data can be a string or a buffer.
var writeFileAtomic = require('write-file-atomic')
writeFileAtomic(filename, data, [options], [callback])
The file is initially named filename + "." + murmurhex(__filename, process.pid, ++invocations)
.
Note that require('worker_threads').threadId
is used in addition to process.pid
if running inside of a worker thread.
If writeFile completes successfully then, if passed the chown option it will change
the ownership of the file. Finally it renames the file back to the filename you specified. If
it encounters errors at any of these steps it will attempt to unlink the temporary file and then
pass the error back to the caller.
If multiple writes are concurrently issued to the same file, the write operations are put into a queue and serialized in the order they were called, using Promises. Writes to different files are still executed in parallel.
If provided, the chown option requires both uid and gid properties or else
you'll get an error. If chown is not specified it will default to using
the owner of the previous file. To prevent chown from being ran you can
also pass false
, in which case the file will be created with the current user's credentials.
If mode is not specified, it will default to using the permissions from
an existing file, if any. Expicitly setting this to false
remove this default, resulting
in a file created with the system default permissions.
If options is a String, it's assumed to be the encoding option. The encoding option is ignored if data is a buffer. It defaults to 'utf8'.
If the fsync option is false, writeFile will skip the final fsync call.
If the tmpfileCreated option is specified it will be called with the name of the tmpfile when created.
Example:
writeFileAtomic('message.txt', 'Hello Node', {chown:{uid:100,gid:50}}, function (err) {
if (err) throw err;
console.log('It\'s saved!');
});
This function also supports async/await:
(async () => {
try {
await writeFileAtomic('message.txt', 'Hello Node', {chown:{uid:100,gid:50}});
console.log('It\'s saved!');
} catch (err) {
console.error(err);
process.exit(1);
}
})();
writeFileAtomicSync(filename, data, [options])
The synchronous version of writeFileAtomic.
var writeFileAtomicSync = require('write-file-atomic').sync
writeFileAtomicSync(filename, data, [options])
6.0.0 (2024-09-24)
write-file-atomic
now supports node ^18.17.0 || >=20.5.0
384ec4c
#208 run template-oss-apply (@hashtagchris)1a8883d
#206 bump @npmcli/eslint-config from 4.0.5 to 5.0.0 (@dependabot[bot])73bddd9
#194 linting: no-unused-vars (@lukekarrys)4a16903
#194 bump @npmcli/template-oss to 4.22.0 (@lukekarrys)944e6c2
#207 postinstall for dependabot template-oss PR (@hashtagchris)c2c17b7
#207 bump @npmcli/template-oss from 4.23.1 to 4.23.3 (@dependabot[bot])FAQs
Write files in an atomic fashion w/configurable ownership
The npm package write-file-atomic receives a total of 53,396,424 weekly downloads. As such, write-file-atomic popularity was classified as popular.
We found that write-file-atomic demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.