
Research
npm Malware Targets Telegram Bot Developers with Persistent SSH Backdoors
Malicious npm packages posing as Telegram bot libraries install SSH backdoors and exfiltrate data from Linux developer machines.
nodejs-wheel-binaries
Advanced tools
nodejs-wheel
is an unofficial repository to distribute Node.js prebuilt wheels through PyPI using
pip install nodejs-wheel
New in v20.13.0: If you don't need command line interface (CLI), install only nodejs-wheel-binaries
, which is a direct dependency of nodejs-wheel
.
pip install nodejs-wheel-binaries
The package requires Python 3.7 and above.
The project is powered by scikit-build-core and cibuildwheel.
OS | Arch | Bit | Conditions | New in |
---|---|---|---|---|
Linux | x86_64 | 64 | glibc >= 2.17 | v18.18.0 |
Linux | x86_64 | 64 | musl >= 1.2 | v20.14.0 |
Linux | aarch64 | 64 | glibc >= 2.17 | v20.13.0 |
Linux | aarch64 | 64 | musl >= 1.2 | v22.13.1 |
macOS | x86_64 | 64 | >= macOS-11 | v18.18.0 |
macOS | arm64 | 64 | >= macOS-11 | v20.11.1 |
Windows | amd64 | 64 | v18.18.0 | |
Windows | arm64 | 64 | v22.12.0 |
Only available in the nodejs-wheel
package.
node -h
npm -h
npx -h
# New in v22.13.1
corepack -h
New in v20.13.0.
Only support node
.
python -m nodejs_wheel --version
New in v20.13.0.
from nodejs_wheel import (
node,
npm,
npx,
# corepack: New in v22.13.1
corepack,
)
return_code0 = node(["--version"])
return_code1 = npm(["--version"])
return_code2 = npx(["--version"])
# corepack: New in v22.13.1
return_code3 = corepack(]"--version"])
New in v20.13.1: pass return_completed_process=True
to get subprocess.CompletedProcess
instead of int
.
completed_process0 = node(["--version"], return_completed_process=True)
completed_process1 = npm(["--version"], return_completed_process=True)
completed_process2 = npx(["--version"], return_completed_process=True)
# corepack: New in v22.13.1
completed_process3 = corepack(["--version"], return_completed_process=True)
nodejs-wheel
distributed under the same MIT license as Node.js.
The project is inspired by many other similiar projects:
FAQs
unoffical Node.js package
We found that nodejs-wheel-binaries demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Malicious npm packages posing as Telegram bot libraries install SSH backdoors and exfiltrate data from Linux developer machines.
Security News
pip, PDM, pip-audit, and the packaging library are already adding support for Python’s new lock file format.
Product
Socket's Go support is now generally available, bringing automatic scanning and deep code analysis to all users with Go projects.