
Security News
Socket Named a Supply Chain Innovator in Latio's 2026 Application Security Market Report
Latio’s 2026 report recognizes Socket as a Supply Chain Innovator and highlights our work in 0-day malware detection, SCA, and auto-patching.
$ npm i -g dry-dry
$ dry init
Because companies and other groups have bunch of package.json attributes that are the same across all npm projects.
Those attributes must be maintained using copy/paste across all projects.
This is wrong !
We believe that those attributes should be easily distributed and updated across projects.
Because most of multi module project use multiple version of the same dependencies. Bundling an application with those modules may be challenging.
Dry provide a mecanism to centralize dependencies version management.
dry is a stupid npm wrapper allowing any package.json to extend a parent file.
The parent file can be located on the system or simply inside a published npm module.
On each dry command, dry:
package.json based on the provided package-dry.jsonnpm commandpackage.json modifications made by npm to package-dry.jsonpackage.jsonpackage.json is always removed to make sure that nobody will execute a pure npm command in a dry project.

package-dry.json
{
"name": "parent",
"version": "1.0.0",
"description": "",
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1",
"foo": "npm help"
},
"keywords": [],
"author": "",
"license": "ISC",
"dependencyManagement": {
"dependency-one": "1.0.0",
"dependency-two": "2.0.0",
"dev-dependency-one": "1.1.0",
"dev-dependency-two": "2.2.0"
}
}
package-dry.json
{
"name": "child",
"version": "1.0.0",
"description": "",
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"keywords": [],
"author": "",
"license": "ISC",
"dry": {
"extends": "parent/package-dry.json",
"dependencies": {
"parent": "1.0.0"
}
},
"dependencies": {
"dependency-one": "managed",
"dependency-three": "1.2.3"
},
"devDependencies": {
"dev-dependency-two": "managed",
"dev-dependency-three": "1.2.3"
}
}
Merged package.json
{
"name": "child",
"version": "1.0.0",
"description": "",
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1",
"foo": "npm help"
},
"keywords": [],
"author": "",
"license": "ISC",
"dependencies": {
"dependency-one": "1.0.0",
"dependency-three": "1.2.3"
},
"devDependencies": {
"dev-dependency-two": "1.1.0",
"dev-dependency-three": "1.2.3"
}
}
To do that, dry introduces a file named package-dry.json.
package-dry.json replaces package.json in your dry projects.
Of course, it can contain all the attributes of package.json with the addition of an attribute called dry.
package-dry.json dry attribute has 2 optional attributes:
extends - The parent of the current dry packagedependencies - The dependencies needed to resolve the file pointed by extends. Those dependencies will not be saved to your project.dry proxies all received arguments to npm.
Just take your usual npm commands and replace the word npm with dry.
| npm | dry |
|---|---|
| npm init | dry init |
| npm i | dry i |
| npm install | dry install |
| npm publish | dry publish |
| npm x y z | dry x y z |
The dry command accepts some additional parameters
--dry-keep-package-json' : when provided the generated package.json file is not deleted
--dry-save-package-json-to' target_file_path : when provided a copy of the generated package.json file is done to target_file_path location
FAQs
Use npm across multiple projects without repeating yourself
The npm package dry-dry receives a total of 305 weekly downloads. As such, dry-dry popularity was classified as not popular.
We found that dry-dry demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Latio’s 2026 report recognizes Socket as a Supply Chain Innovator and highlights our work in 0-day malware detection, SCA, and auto-patching.

Company News
Join Socket for live demos, rooftop happy hours, and one-on-one meetings during BSidesSF and RSA 2026 in San Francisco.

Research
/Security News
Malicious Packagist packages disguised as Laravel utilities install an encrypted PHP RAT via Composer dependencies, enabling remote access and C2 callbacks.