
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
engine-test
Advanced tools
Demand a Node or npm version to run your app.
npm install engine-test --save
Get it into your program.
const engineTest = require('engine-test');
Ask whether the current Node and/or npm in use are acceptable based on the engines in your package.json.
engineTest().then((satisfied) => {
if (!satisfied) {
console.error('Hey Jane! Update your Node.');
}
});
If you want to override the expectations of your package.json, you can.
engineTest({npm : '2.x'}).then((satisfied) => {
// true if on any version of npm 2
console.log(satisfied);
});
If you happen to already have data on-hand about the user's current engines, you can save time by providing it. This is particularly good for npm, since its version must be determined asynchronously if it is not provided.
engineTest({npm : '2.x'}, {npm: '3.0.0'})
.then((satisfied) => {
console.log(satisfied); // => false
});
Ask for a more detailed report.
engineTest(undefined, undefined, {detail : true})
.then((engines) => {
console.log(engines);
// {
// allSatisfied : false,
// satisfied : {
// npm : {
// expected : '^2.0.0',
// actual : '2.14.2'
// }
// },
// notSatisfied : {
// node : {
// expected : '>4.2.0',
// actual : '4.0.0'
// }
// }
// }
});
Have Engine Test automatically reject the promise with a nice reason error, allowing you to easily register a handler that will only run when the user has compatible engines. If they don't, they will see a nice stack trace.
engineTest.assert().then((satisfied) => {
// Do anything. User is gauranteed to have compatible engines.
console.log('Hey Jane! You are good to go.');
});
See our contributing guidelines for more details.
git checkout -b my-new-featuregit commit -am 'Add some feature'git push origin my-new-featureGo make something, dang it.
FAQs
Demand a Node or npm version to run your app.
We found that engine-test demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.