Gathering detailed insights and metrics for @latiwesh/get-pkg-repo
Gathering detailed insights and metrics for @latiwesh/get-pkg-repo
Get repository user and project information from package.json file contents.
Installations
npm install @latiwesh/get-pkg-repoDeveloper Guide
BETA
Typescript
No
Module System
CommonJS
Min. Node Version
>=6.9.0
Node Version
12.16.1
NPM Version
6.14.8
Releases
6
Languages
1
JavaScript
JavaScript (100%)
Developer
conventional-changelog
Download Statistics
Total Downloads
0
Last Day
0
Last Week
0
Last Month
0
Last Year
0
GitHub Statistics
MIT License
16 Stars
106 Commits
13 Forks
2 Watchers
20 Branches
18 Contributors
Updated on Mar 18, 2025
Maintainers
1
Package Meta Information
Latest Version
2.0.1
Package Id
@latiwesh/get-pkg-repo@2.0.1
Unpacked Size
15.69 kB
Size
5.07 kB
File Count
6
NPM Version
6.14.8
Node Version
12.16.1
Total Downloads
Cumulative downloads
Total Downloads
NaN
Last Day
0%
NaN
Compared to previous day
Last Week
0%
NaN
Compared to previous week
Last Month
0%
NaN
Compared to previous month
Last Year
0%
NaN
Compared to previous year
Weekly Downloads
Monthly Downloads
Yearly Downloads
get-pkg-repo
Get repository SCM platform, domain, user, and project information from package.json file contents.
Extracts information from the repository field contained in the content of a package.json file using @hutson/parse-repository-url and hosted-git-info.
Table of Contents
Features
- Return
browsefunction that returns URL usable in a browser. (Similar tohosted-git-info) - Return
domainproperty containing the fully qualified domain name and port. - Return
projectproperty. - Return
typeproperty indicating the SCM host, such asgithuborgitlab. - Return
userproperty.
*Note: Returns
nullfor any property where the information could not be extracted from the repository URL.
Installation
To install the get-pkg-repo tool please run the following command:
1yarn [global] add [--dev] get-pkg-repo
Usage
There are two ways to use get-pkg-repo, either as a CLI tool, or programmatically.
Programmatically
Package data must be passed as an object to get-pkg-repo function. If the contents of the package.json are a string, please pass it through JSON.parse first.
1const getPkgRepo = require(`get-pkg-repo`); 2 3/* Assume the `package.json` file contains the following: 4{ 5 "repository": { 6 "url": `https://github.com/conventional-changelog/get-pkg-repo` 7 } 8} 9*/ 10fs.readFile(`package.json`, (err, packageData) => { 11 if (err) { 12 ... 13 } 14 15 // {domain: `github.com`, project: `get-pkg-repo`, type: `github`, user: `conventional-changelog`} 16 const repository = getPkgRepo(JSON.parse(packageData)); 17 18 repository.browse(); // https://github.com/conventional-changelog/get-pkg-repo 19});
CLI Tool
After you've installed get-pkg-repo, you can call the tool based on whether you installed it globally or locally:
Globally
1get-pkg-repo package.json
Locally
1$(yarn bin)/get-pkg-repo package.json
1$ get-pkg-repo package.json 2 3{ 4 domain: `github.com`, 5 project: `get-pkg-repo`, 6 type: `github`, 7 user: `conventional-changelog` 8}
The contents of the package.json can also be piped to get-pkg-repo:
$ cat package.json | get-pkg-repo
{
domain: `github.com`,
project: `get-pkg-repo`,
type: `github`,
user: `conventional-changelog`
}
Debugging
To assist users of get-pkg-repo with debugging the behavior of this module we use the debug utility package to print information about the publish process to the console. To enable debug message printing, the environment variable DEBUG, which is the variable used by the debug package, must be set to a value configured by the package containing the debug messages to be printed.
To print debug messages on a unix system set the environment variable DEBUG with the name of this package prior to executing get-pkg-repo:
1DEBUG=get-pkg-repo get-pkg-repo
On the Windows command line you may do:
1set DEBUG=get-pkg-repo 2get-pkg-repo
Node Support Policy
We only support Long-Term Support versions of Node.
We specifically limit our support to LTS versions of Node, not because this package won't work on other versions, but because we have a limited amount of time, and supporting LTS offers the greatest return on that investment.
It's possible this package will work correctly on newer versions of Node. It may even be possible to use this package on older versions of Node, though that's more unlikely as we'll make every effort to take advantage of features available in the oldest LTS version we support.
As each Node LTS version reaches its end-of-life we will remove that version from the node engines property of our package's package.json file. Removing a Node version is considered a breaking change and will entail the publishing of a new major version of this package. We will not accept any requests to support an end-of-life version of Node. Any merge requests or issues supporting an end-of-life version of Node will be closed.
We will accept code that allows this package to run on newer, non-LTS, versions of Node. Furthermore, we will attempt to ensure our own changes work on the latest version of Node. To help in that commitment, our continuous integration setup runs against all LTS versions of Node in addition the most recent Node release; called current.
JavaScript package managers should allow you to install this package with any version of Node, with, at most, a warning if your version of Node does not fall within the range specified by our node engines property. If you encounter issues installing this package, please report the issue to your package manager.
Contributing
Please read our contributing guide on how you can help improve this project.
No vulnerabilities found.
Reason
no dangerous workflow patterns detected
Reason
no binaries found in the repo
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
Found 1/17 approved changesets -- score normalized to 0
Reason
0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yaml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/get-pkg-repo/ci.yaml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/get-pkg-repo/ci.yaml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yaml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/get-pkg-repo/ci.yaml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yaml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/get-pkg-repo/ci.yaml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-please.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/get-pkg-repo/release-please.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-please.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/get-pkg-repo/release-please.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-please.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/get-pkg-repo/release-please.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-please.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/get-pkg-repo/release-please.yml/master?enable=pin
- Warn: npmCommand not pinned by hash: .github/workflows/ci.yaml:21
- Warn: npmCommand not pinned by hash: .github/workflows/release-please.yml:21
- Warn: npmCommand not pinned by hash: .github/workflows/release-please.yml:27
- Info: 0 out of 7 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 1 third-party GitHubAction dependencies pinned
- Info: 0 out of 3 npmCommand dependencies pinned
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/ci.yaml:1
- Warn: no topLevel permission defined: .github/workflows/release-please.yml:1
- Info: no jobLevel write permissions found
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
security policy file not detected
Details
- Warn: no security policy file detected
- Warn: no security file to analyze
- Warn: no security file to analyze
- Warn: no security file to analyze
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 15 are checked with a SAST tool
Reason
50 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-67hx-6x53-jw92
- Warn: Project is vulnerable to: GHSA-6chw-6frg-f759
- Warn: Project is vulnerable to: GHSA-v88g-cgmw-v5xw
- Warn: Project is vulnerable to: GHSA-93q8-gq69-wqmw
- Warn: Project is vulnerable to: GHSA-fwr7-v2mv-hh25
- Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw
- Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
- Warn: Project is vulnerable to: GHSA-gxpj-cx7g-858c
- Warn: Project is vulnerable to: GHSA-w573-4hg7-7wgq
- Warn: Project is vulnerable to: GHSA-ff7x-qrg7-qggm
- Warn: Project is vulnerable to: GHSA-3gx7-xhv7-5mx3
- Warn: Project is vulnerable to: GHSA-4q6p-r6v2-jvc5
- Warn: Project is vulnerable to: GHSA-pfrx-2q88-qq97
- Warn: Project is vulnerable to: GHSA-q42p-pg8m-cqh6
- Warn: Project is vulnerable to: GHSA-w457-6q6x-cgp9
- Warn: Project is vulnerable to: GHSA-62gr-4qp9-h98f
- Warn: Project is vulnerable to: GHSA-f52g-6jhx-586p
- Warn: Project is vulnerable to: GHSA-2cf5-4w76-r9qv
- Warn: Project is vulnerable to: GHSA-3cqr-58rm-57f8
- Warn: Project is vulnerable to: GHSA-g9r4-xpmj-mj65
- Warn: Project is vulnerable to: GHSA-q2c6-c6pm-g3gh
- Warn: Project is vulnerable to: GHSA-765h-qjxv-5f44
- Warn: Project is vulnerable to: GHSA-f2jv-r9rf-7988
- Warn: Project is vulnerable to: GHSA-43f8-2h32-f4cj
- Warn: Project is vulnerable to: GHSA-rc47-6667-2j5j
- Warn: Project is vulnerable to: GHSA-qqgx-2p2h-9c37
- Warn: Project is vulnerable to: GHSA-2pr6-76vf-7546
- Warn: Project is vulnerable to: GHSA-8j8c-7jfh-h6hx
- Warn: Project is vulnerable to: GHSA-jf85-cpcp-j695
- Warn: Project is vulnerable to: GHSA-p6mc-m468-83gw
- Warn: Project is vulnerable to: GHSA-29mw-wpgm-hmr9
- Warn: Project is vulnerable to: GHSA-35jh-r3h4-6jhm
- Warn: Project is vulnerable to: GHSA-h726-x36v-rx45
- Warn: Project is vulnerable to: GHSA-4xcv-9jjx-gfj3
- Warn: Project is vulnerable to: GHSA-vh95-rmgr-6w4m
- Warn: Project is vulnerable to: GHSA-xvch-5gv4-984h
- Warn: Project is vulnerable to: GHSA-mwcw-c2x4-8c55
- Warn: Project is vulnerable to: GHSA-hj48-42vr-x3v9
- Warn: Project is vulnerable to: GHSA-g6ww-v8xp-vmwg
- Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
- Warn: Project is vulnerable to: GHSA-44c6-4v22-4mhx
- Warn: Project is vulnerable to: GHSA-4x5v-gmq8-25ch
- Warn: Project is vulnerable to: GHSA-76p7-773f-r4q5
- Warn: Project is vulnerable to: GHSA-4rq4-32rv-6wp6
- Warn: Project is vulnerable to: GHSA-64g7-mvw6-v9qj
- Warn: Project is vulnerable to: GHSA-7p7h-4mm5-852v
- Warn: Project is vulnerable to: GHSA-38fc-wpqx-33j7
- Warn: Project is vulnerable to: GHSA-c4w7-xm78-47vh
- Warn: Project is vulnerable to: GHSA-p9pc-299p-vxgp
Score
2.8
/10
Last Scanned on 2025-07-07
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More