Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
better-npm-run
Advanced tools
Better NPM scripts runner
From this:
{
"scripts": {
"build:dist": "NODE_ENV=development webpack --config $npm_package_webpack --progress --colors",
"test": "NODE_ENV=production karma start"
}
}
To this:
{
"devDependencies": {
"better-npm-run": "~0.0.1"
},
"scripts": {
"build:dist": "better-npm-run build:dist",
"build:prod": "better-npm-run build:prod",
"test": "better-npm-run test"
},
"betterScripts": {
"build:dist": "webpack --config $npm_package_webpack --progress --colors",
"build:prod": {
"command": "webpack --config $npm_package_webpack --progress --colors",
"env": {
"NODE_ENV": "production"
}
},
"test": {
"command": "karma start",
"env": {
"NODE_ENV": "test"
}
}
}
}
The betterScripts
script definition can either be a string or sub-object with command
and env
attributes. Values defined in the env
block will override previously set environment variables.
Note that depending on the OS and terminal you're using, dots, spaces or other special characters in the command path may be treated as separators and the command will be parsed wrong.
{
"serve:dist": "./node_modules/.bin/webpack-dev-server --hot --inline --config webpack/development.js"
}
To prevent this you need to explicitly wrap the command path with double quotes:
{
"serve:dist": "\"./node_modules/.bin/webpack-dev-server\" --hot --inline --config webpack/development.js"
}
If you have an .env
file in your project root it will be loaded on every command.
NODE_PATH=./:./lib
NODE_ENV=development
PORT=5000
Environment variables defined in the betterScripts
script definition will take precedence over .env
values.
Currently, using bash variables (PWD, USER, etc.) is not possible:
"command": "forever start -l ${PWD}/logs/forever.log -o ${PWD}/logs/out.log -e ${PWD}/logs/errors.log -a index.js",
In order to use them, you can create an script file (.sh
) instead:
forever.sh
:
forever start -l ${PWD}/logs/forever.log -o ${PWD}/logs/out.log -e ${PWD}/logs/errors.log -a index.js
package.json
:
"command": "./forever.sh"
This module expose 2 cli commands:
better-npm-run
and,bnr
which is an alias to the former.The shorter one is useful for cases where you have a script that calls several better-npm-run
scripts. e.g:
using the normal cli name
"scripts": {
"dev": "shell-exec 'better-npm-run install-hooks' 'better-npm-run watch-client' 'better-npm-run start-dev' 'better-npm-run start-dev-api' 'better-npm-run start-dev-worker' 'better-npm-run start-dev-socket'",
}
using the shorter alias
"scripts": {
"dev": "shell-exec 'bnr install-hooks' 'bnr watch-client' 'bnr start-dev' 'bnr start-dev-api' 'bnr start-dev-worker' 'bnr start-dev-socket'",
}
And for silence output, you can use -s
or verbose --silence
flags
bnr -s watch-client
And you can use -p
or verbose --path
to specify a custom path of dotenv file
bnr --path=/custom/path/to/your/env/vars start-dev
Also use -e
or verbose --encoding
to specify the encoding of dotenv file
bnr --encoding=base64 start-dev
See envdot docs for more infomation
FAQs
Better NPM scripts runner
We found that better-npm-run demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.