
Security News
Another Round of TEA Protocol Spam Floods npm, But It’s Not a Worm
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.
better-npm-run
Advanced tools

Better NPM scripts runner
From this:
{
"scripts": {
"build:dist": "NODE_ENV=development webpack --config $npm_package_webpack --progress --colors",
"test": "NODE_ENV=production karma start"
}
}
To this:
{
"devDependencies": {
"better-npm-run": "~0.0.1"
},
"scripts": {
"build:dist": "better-npm-run build:dist",
"build:prod": "better-npm-run build:prod",
"test": "better-npm-run test"
},
"betterScripts": {
"build:dist": "webpack --config $npm_package_webpack --progress --colors",
"build:prod": {
"command": "webpack --config $npm_package_webpack --progress --colors",
"env": {
"NODE_ENV": "production"
}
},
"test": {
"command": "karma start",
"env": {
"NODE_ENV": "test"
}
}
}
}
The betterScripts script definition can either be a string or sub-object with command and env attributes. Values defined in the env block will override previously set environment variables.
Note that depending on the OS and terminal you're using, dots, spaces or other special characters in the command path may be treated as separators and the command will be parsed wrong.
{
"serve:dist": "./node_modules/.bin/webpack-dev-server --hot --inline --config webpack/development.js"
}
To prevent this you need to explicitly wrap the command path with double quotes:
{
"serve:dist": "\"./node_modules/.bin/webpack-dev-server\" --hot --inline --config webpack/development.js"
}
If you have an .env file in your project root it will be loaded on every command.
NODE_PATH=./:./lib
NODE_ENV=development
PORT=5000
Environment variables defined in the betterScripts script definition will take precedence over .env values.
Currently, using bash variables (PWD, USER, etc.) is not possible:
"command": "forever start -l ${PWD}/logs/forever.log -o ${PWD}/logs/out.log -e ${PWD}/logs/errors.log -a index.js",
In order to use them, you can create an script file (.sh) instead:
forever.sh:
forever start -l ${PWD}/logs/forever.log -o ${PWD}/logs/out.log -e ${PWD}/logs/errors.log -a index.js
package.json:
"command": "./forever.sh"
This module expose 2 cli commands:
better-npm-run and,bnr which is an alias to the former.The shorter one is useful for cases where you have a script that calls several better-npm-run scripts. e.g:
using the normal cli name
"scripts": {
"dev": "shell-exec 'better-npm-run install-hooks' 'better-npm-run watch-client' 'better-npm-run start-dev' 'better-npm-run start-dev-api' 'better-npm-run start-dev-worker' 'better-npm-run start-dev-socket'",
}
using the shorter alias
"scripts": {
"dev": "shell-exec 'bnr install-hooks' 'bnr watch-client' 'bnr start-dev' 'bnr start-dev-api' 'bnr start-dev-worker' 'bnr start-dev-socket'",
}
And for silence output, you can use -s or verbose --silence flags
bnr -s watch-client
And you can use -p or verbose --path to specify a custom path of dotenv file
bnr --path=/custom/path/to/your/env/vars start-dev
Also use -e or verbose --encoding to specify the encoding of dotenv file
bnr --encoding=base64 start-dev
See envdot docs for more infomation
FAQs
Better NPM scripts runner
The npm package better-npm-run receives a total of 30,257 weekly downloads. As such, better-npm-run popularity was classified as popular.
We found that better-npm-run demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.

Security News
PyPI adds Trusted Publishing support for GitLab Self-Managed as adoption reaches 25% of uploads

Research
/Security News
A malicious Chrome extension posing as an Ethereum wallet steals seed phrases by encoding them into Sui transactions, enabling full wallet takeover.