
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@kumori/binary-install
Advanced tools
binary-cli-install is a tool to install CLIs written in go, rust, c, etc with npm/yarn into a node project.
$ npm install --dev-save binary-cli-install
$ yarn add -D binary-cli-install
Create a new npm package (needed props: [version, bin, binary])
Create a entrypoint.js and set as as the bin file in your package.json
Add a binary object to your package.json with
name property set to the name of your cli
url property set to the download link
// package.json
{
"name": "runtime-env",
"version": "0.0.0",
"bin": {
"exmplae": "entrypoint.js"
},
"files": ["entrypoint.js"],
"dependencies": {
"binary-cli-install": "file:/home/simon/src/binary-cli-install/"
},
"binary": {
"name": "runtime-env",
"url": "https://github.com/example/example/releases/download/v{{version}}/runtime-env_{{version}}_{{platform}}_{{arch}}.tar.gz"
}
}
// entrypoint.js
// importing both the Binary class and Mapper obejcts specificly for go to map the node arch & platform names to the go names
const {
Binary,
GO_ARCH_MAPPING,
GO_PLATFORM_MAPPING,
} = require("binary-cli-install");
// import your package.json
const { join } = require("path");
const packageJson = require(join("..", "package.json"));
// Pass the mappers and your package.json to the Binary class
const bin = new Binary(
packageJson,
GO_ARCH_MAPPING,
GO_PLATFORM_MAPPING,
false // set debug to true with info messages should be logged
);
bin.run();
Your entrypoint.js script will be put into the node_modules/.bin folder when your package is installed. It acts as a placeholder and will be replaced after the first execution with the binary CLI. To keep a consistent user experience, the js script will call the binary on the first run every run afterwards will just be the binary cli no js wrapper.
FAQs
A npm package to install cli binaries
The npm package @kumori/binary-install receives a total of 1 weekly downloads. As such, @kumori/binary-install popularity was classified as not popular.
We found that @kumori/binary-install demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.