
Research
Security News
Malicious PyPI Package Exploits Deezer API for Coordinated Music Piracy
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
@ui-leonard-lin/install-peerdeps
Advanced tools
As seen on the README of Airbnb's ESLint config!
Disclaimer: Airbnb is not affiliated with, and does not endorse, this CLI tool
A command-line interface to install an NPM package and its peer dependencies automatically.
Starting with NPM v3.0, peer dependencies are not automatically installed on npm install
, and it can be a hassle to install them all manually. The install-peerdeps
tool makes the process fast and easy.
Also works with Yarn.
# If you're using npm
npm install -g install-peerdeps
# If you're using yarn
yarn global add install-peerdeps
cd my-project-directory
install-peerdeps <package>[@<version>]
The specified package along with its peer dependencies will be installed.
It's true that on Linux you can run something like this to automatically install peerDeps (taken from AirBnb's eslint config repo):
(
export PKG=eslint-config-airbnb;
npm info "$PKG@latest" peerDependencies --json | command sed 's/[\{\},]//g ; s/: /@/g' | xargs npm install --save-dev "$PKG@latest"
)
However, the above solution is hard to remember, and doesn't work on Windows. This tool aims to solve both of these problems.
Usage: install-peerdeps <package>[@<version>], default version is 'latest'
Installs the specified package along with correct peerDeps.
Options:
-V, --version output the version number
-D Install the package as a devDependency (alias for `-d`)
-d, --dev Install the package as a devDependency
-g, --global Install the package globally
-o, --only-peers Install only peerDependencies of the package
-S, --silent If using npm, don't save in package.json
-Y, --yarn Install with Yarn
-P, --pnpm Install with pnpm
-n, --no-registry Do not use a remote registry to find dependencies list
--dry-run Do not install packages, but show the install command that will be run
-x, --extra-args "<extra_args>" Extra arguments to pass through to NPM or Yarn
-h, --help output usage information
Only core Yarn and NPM arguments relating to package installation are officially provided by install-peerdeps
. However, if you'd like to pass through additional arguments, you may do so with --extra-args
. Here's how you'd install a package into a Yarn-workspace-enabled repository:
install-peerdeps <package> --dev -Y --extra-args "-W"
Here's how you'd use --extra-args
to pass a custom NPM config option (in this case, disabling strict-ssl
when accessing a custom registry over HTTPS):
install-peerdeps <package> --extra-args "--strict-ssl false"
eslint-config-airbnb
requires quite a few peer dependencies. Here's what you'd do to install them all:
install-peerdeps eslint-config-airbnb --dev
install-peerdeps
will automatically detect whether you're using Yarn. If you are, it'll prompt you as to whether you want to use Yarn or npm to install the packages.
# If you're using npm
npm install eslint-config-airbnb@18.2.1 eslint@^7.2.0 eslint-plugin-import@^2.22.1 eslint-plugin-jsx-a11y@^6.4.1 eslint-plugin-react@^7.21.5 eslint-plugin-react-hooks@^1.7.0 --save-dev
# If you're using yarn
yarn add eslint-config-airbnb@18.2.1 eslint@^7.2.0 eslint-plugin-import@^2.22.1 eslint-plugin-jsx-a11y@^6.4.1 eslint-plugin-react@^7.21.5 eslint-plugin-react-hooks@^1.7.0 --dev
If you'd like to install a different version of a package than the latest (the default), simply specify the version like so:
install-peerdeps @angular/core@next
The tool will automatically install the version corresponding to the tag, as well as its peer dependencies:
Installing peerdeps for @angular/core@next.
yarn add @angular/core@11.2.0-next.0 rxjs@^6.5.3 zone.js@^0.11.3 --dev
See CONTRIBUTING.md
FAQs
CLI to automatically install peerDeps
The npm package @ui-leonard-lin/install-peerdeps receives a total of 0 weekly downloads. As such, @ui-leonard-lin/install-peerdeps popularity was classified as not popular.
We found that @ui-leonard-lin/install-peerdeps demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.
Security News
Newly introduced telemetry in devenv 1.4 sparked a backlash over privacy concerns, leading to the removal of its AI-powered feature after strong community pushback.