kill-port 2.0.1 kills the wrong port on Windows: bugs found and a kill-port-safe replacement

An analysis found that the popular npm package kill-port (2.1M weekly downloads) in version 2.0.1 kills processes on ports like 30001 when asked to free 3000 on Windows, due to a regex without an end anchor, and falsely reports success on Linux and macOS. The author released kill-port-safe, a zero-dependency replacement with exact port matching, /proc-based lookup instead of lsof, --graceful support and correct exit codes.

• kill-port 2.0.1 on Windows kills ports 30001, 30002 when asked for 3000 due to an unanchored regex
• On Linux and macOS it falsely prints "Process killed" and exits 0 even when nothing was killed
• kill-port-safe needs no lsof, reads /proc/net/tcp and has zero dependencies
• In November 2025 kill-port versions 2.0.2 and 2.0.3 were infected by the Shai-Hulud worm