
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
@npmcli/map-workspaces
Advanced tools
Retrieves a name:pathname Map for a given workspaces config.
Long version: Reads the workspaces property from a valid workspaces configuration object and traverses the paths and globs defined there in order to find valid nested packages and return a Map of all found packages where keys are package names and values are folder locations.
npm install @npmcli/map-workspaces
const mapWorkspaces = require('@npmcli/map-workspaces')
await mapWorkspaces({
cwd,
pkg: {
workspaces: {
packages: [
"a",
"b"
]
}
}
})
// ->
// Map {
// 'a': '<cwd>/a'
// 'b': '<cwd>/b'
// }
Given a folder structure such as:
├── package.json
└── apps
├── a
│ └── package.json
├── b
│ └── package.json
└── c
└── package.json
const mapWorkspaces = require('@npmcli/map-workspaces')
await mapWorkspaces({
cwd,
pkg: {
workspaces: [
"apps/*"
]
}
})
// ->
// Map {
// 'a': '<cwd>/apps/a'
// 'b': '<cwd>/apps/b'
// 'c': '<cwd>/apps/c'
// }
mapWorkspaces(opts) -> Promise<Map>opts:
pkg: A valid package.json Objectcwd: A String defining the base directory to use when reading globs and paths.ignore: An Array of paths to be ignored when using globs to look for nested package.A Map in which keys are package names and values are the pathnames for each found workspace.
Lerna is a tool for managing JavaScript projects with multiple packages, known as a monorepo. It provides similar functionalities to @npmcli/map-workspaces by allowing you to run scripts, publish packages, and more across multiple workspaces. However, Lerna is more feature-rich and can handle complex workflows, including versioning and publishing.
Yarn Workspaces is a feature built into Yarn that automatically manages the installation of dependencies and linking of packages in a monorepo. It offers similar workspace mapping functionalities but is tightly integrated with Yarn's package management capabilities. Unlike @npmcli/map-workspaces, Yarn Workspaces is not a separate package but a feature of Yarn itself.
FAQs
Retrieves a name:pathname Map for a given workspaces config
The npm package @npmcli/map-workspaces receives a total of 6,250,065 weekly downloads. As such, @npmcli/map-workspaces popularity was classified as popular.
We found that @npmcli/map-workspaces demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.