# package-hash

> Generates a hash for an installed npm package, useful for salting caches

Latest version **4.0.0** (published 2019-04-09) · ISC license · 0 weekly downloads

## Install

```sh
npm install package-hash
pnpm add package-hash
yarn add package-hash
bun add package-hash
```

## Health

**Score 15/100 (F)** — status: abandoned.

Positive: no vulnerabilities.

Warnings: low downloads; no types; no esm support.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 4.0.0 |
| Published | 2019-04-09 |
| First published | 2016-04-14 |
| Weekly downloads | 0 |
| License | ISC |
| TypeScript types | none |
| Module format | CommonJS |
| Node | >=8 |
| Dependencies | 4 |
| Unpacked size | 9 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 19 |
| Author | Mark Wubben |
| Maintainers | coreyfarrell, novemberborn |

## Links

- npm: https://www.npmjs.com/package/package-hash
- Repository: https://github.com/novemberborn/package-hash
- Homepage: https://github.com/novemberborn/package-hash#readme
- Issues: https://github.com/novemberborn/package-hash/issues
- npm.io page: https://npm.io/package/package-hash

## Dependencies (4)

- [hasha](https://npm.io/package/hasha.md) ^5.0.0
- [graceful-fs](https://npm.io/package/graceful-fs.md) ^4.1.15
- [release-zalgo](https://npm.io/package/release-zalgo.md) ^1.0.0
- [lodash.flattendeep](https://npm.io/package/lodash.flattendeep.md) ^4.4.0

## Recent versions

- 4.0.0 (latest) — 2019-04-09
- 3.0.0 — 2019-01-16
- 2.0.0 — 2017-02-03
- 1.2.0 — 2016-05-16
- 1.1.0 — 2016-04-17
- 1.0.0 — 2016-04-14

## README

# package-hash

Generates a hash for an installed npm package, useful for salting caches.
[AVA](https://github.com/sindresorhus/ava) for example caches precompiled test
files. It generates a salt for its cache based on the various packages that are
used when compiling the test files.

`package-hash` can generate an appropriate hash based on the package location
(on disk) and the `package.json` file. This hash is salted with a hash
for the `package-hash` itself.

`package-hash` can detect when the package-to-be-hashed is a Git repository. In
the AVA example this is useful when you're debugging one of the packages used to
compile the test files. You can clone it locally and use `npm link` so AVA can
find the clone. The hash will include the HEAD (`.git/HEAD`) and its
corresponding ref (e.g. `.git/refs/heads/master`), any packed refs
(`.git/packed-refs`), as well as the diff (`git diff`) for any non-committed
changes. This makes it really easy to test your changes without having to
explicitly clear the cache in the parent project.

## Installation

```console
$ npm install --save package-hash
```

## Usage

```js
const packageHash = require('package-hash')

// Asynchronously:
const hash = await packageHash(require.resolve('babel-core/package.json'))

// Synchronously:
const hash = packageHash.sync(require.resolve('babel-core/package.json'))
```

`packageHash()` / `packageHash.sync()` must be called with a file path for an
existing `package.json` file. To get the path to an npm package it's easiest to
use `require.resolve('the-name/package.json')`.

You can provide multiple paths:

```js
const hash = await packageHash([
  require.resolve('babel-core/package.json'),
  require.resolve('babel-preset-es2015/package.json')
])
```

An optional salt value can also be provided:

```js
const hash = await packageHash(require.resolve('babel-core/package.json'), 'salt value')
```

## API

### `packageHash(paths, salt?)`

`paths: string | string[]` ➜ can be a single file path, or an array of paths.

`salt: Array | Buffer | Object | string` ➜ optional. If an `Array` or `Object` (not `null`) it is first converted to a JSON string.

Returns a promise for the hex-encoded hash string.

### `packageHash.sync(paths, salt?)`

`paths: string | string[]` ➜ can be a single file path, or an array of paths.

`salt: Array | Buffer | Object | string` ➜ optional. If an `Array` or `Object` (not `null`) it is first converted to a JSON string.

Returns a hex-encoded hash string.

## Compatibility

`package-hash` has been tested with Node.js 8 and above, including Windows
support.

---
_Source: https://npm.io/package/package-hash · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._