Security News
pnpm 10.0.0 Blocks Lifecycle Scripts by Default
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
detect-package-manager
Advanced tools
The detect-package-manager npm package is designed to help developers identify which package manager is being used in a project. This can be particularly useful in scripts or tools that need to adapt their behavior based on the package manager in use.
Detecting the package manager
This feature allows you to detect which package manager (e.g., npm, yarn, pnpm) is being used in the current project. The code sample demonstrates how to use the detect-package-manager package to identify the package manager and log its name.
const detectPM = require('detect-package-manager');
(async () => {
const packageManager = await detectPM();
console.log(`The package manager in use is: ${packageManager.name}`);
})();
Detecting the package manager with options
This feature allows you to specify a custom directory to detect the package manager. The code sample shows how to pass an options object with a 'cwd' property to detect the package manager in a specific directory.
const detectPM = require('detect-package-manager');
(async () => {
const packageManager = await detectPM({ cwd: '/path/to/project' });
console.log(`The package manager in use at the specified path is: ${packageManager.name}`);
})();
The which-pm package is another tool for detecting the package manager being used in a project. It provides similar functionality to detect-package-manager but focuses on simplicity and ease of use. It can be used to determine if npm, yarn, or pnpm is being used.
The pkg-install package is a utility that not only detects the package manager but also provides a unified API for installing dependencies. It abstracts away the differences between npm, yarn, and pnpm, making it easier to write cross-package-manager scripts.
yarn.lock
, package-lock.json
, pnpm-lock.yaml
, or bun.lockb
in current working directory, it will skip other operations and directly resolve yarn
, npm
, pnpm
, or bun
.yarn
, pnpm
, or bun
command exists. If so, it resolves yarn
, pnpm
, or bun
otherwise npm
.yarn add detect-package-manager
const { detect } = require("detect-package-manager");
detect().then((pm) => {
console.log(pm);
//=> 'yarn', 'npm', or 'pnpm', 'bun'
});
opts.cwd
: string
Optional, defaults to .
, the directory to look up yarn.lock
, package-lock.json
, or pnpm-lock.yaml
.opts.includeGlobalBun
: boolean
Optional, defaults to false
, whether to check if bun
exists in PATH.Promise<PM>
It returns a Promise resolving the name of package manager, could be npm
, yarn
, or pnpm
, bun
.
pm
: string
Optional, defaults to npm
, could be npm
, yarn
, or pnpm
, bun
Promise<string>
It returns a Promise resolving the version of npm or the package manager you specified.
void
Clear cache.
git checkout -b my-new-feature
git commit -am 'Add some feature'
git push origin my-new-feature
detect-package-manager © EGOIST, Released under the MIT License.
Authored and maintained by EGOIST with help from contributors (list).
github.com/egoist · GitHub @EGOIST · Twitter @_egoistlily
FAQs
Detect which package manager you're using (yarn or npm)
The npm package detect-package-manager receives a total of 1,136,133 weekly downloads. As such, detect-package-manager popularity was classified as popular.
We found that detect-package-manager demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.
Research
Security News
Socket researchers have discovered multiple malicious npm packages targeting Solana private keys, abusing Gmail to exfiltrate the data and drain Solana wallets.