
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
- [cross-var](https://www.npmjs.com/package/cross-var) - [cross-var-no-babel](https://www.npmjs.com/package/cross-var-no-babel?activeTab=readme) - [@appicanis/cross-var](https://www.npmjs.com/package/@appicanis/cross-var?activeTab=readme)
cross-letcross-var with updatesI.e cross-let is cross-var with some fixes and improvements.
When using npm scripts it creates a lot of environment variables that are available for you to leverage when executing scripts.
If you'd like to take a look at all of the variables then you can run npm run env in your terminal.
> npm run env
npm_package_name=cross-let
npm_package_author_name=MWT
npm_package_version=2.0.0
... lots more ...
Now you can use those environment variables in your npm scripts by referencing them like the following
{
"name": "World",
"scripts": {
"//": "The following only works on Mac OS X/Linux (bash)",
"bash-script": "echo Hello $npm_package_name"
"//": "The following only works on a Windows machine",
"win-script": "echo Hello %npm_package_name%"
}
}
> npm run bash-script
Hello World
However, this won't work on Windows... because it expects the variables to be surrounded by percent signs, so we can change our script just slightly.
cross-let to the Rescue!The goal of cross-let is to let you use one script syntax to work either on a Mac OS X/Linux (bash) or Windows. Reference the Usage documention below on how to use cross-let in your scripts.
{
"version": "1.0.0",
"config": {
"port": "1337"
},
"scripts": {
"prebuild": "cross-let rimraf public/$npm_package_version",
"build:html": "cross-let jade --obj data.json src/index.jade --out public/$npm_package_version/",
"server:create": "cross-let http-server public/$npm_package_version -p $npm_package_config_port",
"server:launch": "cross-let opn http://localhost:$npm_package_config_port"
}
}
{
"version": "1.0.0",
"scripts": {
"build:css": "cross-let \"node-sass src/index.scss | postcss -c .postcssrc.json | cssmin > public/$npm_package_version/index.min.css\"",
"build:js": "cross-let \"mustache data.json src/index.mustache.js | uglifyjs > public/$npm_package_version/index.min.js\"",
}
}
Click on one of the following questions to reveal a detailed answer
However, if you want to support older Windows versions, then you might consider using cross-env or another approach to leverage environment variables in your scripts.
FAQs
- [cross-var](https://www.npmjs.com/package/cross-var) - [cross-var-no-babel](https://www.npmjs.com/package/cross-var-no-babel?activeTab=readme) - [@appicanis/cross-var](https://www.npmjs.com/package/@appicanis/cross-var?activeTab=readme)
The npm package cross-let receives a total of 10 weekly downloads. As such, cross-let popularity was classified as not popular.
We found that cross-let demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.