
Security News
Another Round of TEA Protocol Spam Floods npm, But It’s Not a Worm
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.
electron-packager
Advanced tools
Customize and package your Electron app with OS-specific bundles (.app, .exe, etc.) via JS or CLI
Package your Electron app into OS-specific bundles (.app, .exe, etc.) via JavaScript or the command line.
Supported Platforms | Installation | Usage | API | Contributing | Support | Related Apps/Libraries | FAQ | Release Notes
Electron Packager is a command line tool and Node.js library that bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready for distribution.
For creating distributables like installers and Linux packages, consider using either Electron Forge (which uses Electron Packager internally), or one of the related Electron tools, which utilizes Electron Packager-created folders as a basis.
Note that packaged Electron applications can be relatively large. A zipped, minimal Electron
application is approximately the same size as the zipped prebuilt binary for a given target
platform, target arch, and Electron version
(files named electron-v${version}-${platform}-${arch}.zip).
Electron Packager is known to run on the following host platforms:
It generates executables/bundles for the following target platforms:
win32, for x86, x86_64, and arm64 architectures)darwin) / Mac App Store (also known as mas)* (for x86_64, arm64, and universal architectures)* Note for macOS / Mac App Store target bundles: the .app bundle can only be signed when building on a host macOS platform.
This module requires Node.js 14.17.5 or higher to run.
npm install --save-dev electron-packager
It is not recommended to install electron-packager globally.
Building an Electron app for the Windows target platform requires editing the Electron.exe file.
Currently, Electron Packager uses node-rcedit to accomplish
this. A Windows executable is bundled in that Node package and needs to be run in order for this
functionality to work, so on non-Windows host platforms (not including WSL),
Wine 1.6 or later needs to be installed. On macOS, it is installable
via Homebrew.
JavaScript API usage can be found in the API documentation.
Running Electron Packager from the command line has this basic form:
npx electron-packager <sourcedir> <appname> --platform=<platform> --arch=<arch> [optional flags...]
Note:
npxcan be substituted foryarnornpm execdepending on what package manager and the version you have installed.
This will:
<out>/<appname>-<platform>-<arch> (this can be customized via an optional flag)--platform and --arch can be omitted, in two cases:
--all instead, bundles for all valid combinations of target
platforms/architectures will be created.For an overview of the other optional flags, run electron-packager --help or see
usage.txt. For
detailed descriptions, see the API documentation.
For flags that are structured as objects, you can pass each option as via dot notation as such:
npx electron-packager --flag.foo="bar"
# will pass in { flag: { foo: "bar"} } as an option to the Electron Packager API
If appname is omitted, this will use the name specified by "productName" or "name" in the nearest package.json.
Characters in the Electron app name which are not allowed in all target platforms' filenames
(e.g., /), will be replaced by hyphens (-).
You should be able to launch the app on the platform you built for. If not, check your settings and try again.
Be careful not to include node_modules you don't want into your final app. If you put them in
the devDependencies section of package.json, by default none of the modules related to those
dependencies will be copied in the app bundles. (This behavior can be turned off with the
prune: false API option or --no-prune CLI flag.) In addition, folders like .git and
node_modules/.bin will be ignored by default. You can use --ignore to ignore files and folders
via a regular expression (not a glob pattern).
Examples include --ignore=\.gitignore or --ignore="\.git(ignore|modules)".
Let's assume that you have made an app based on the electron-quick-start repository on a macOS host platform with the following file structure:
foobar
├── package.json
├── index.html
├── […other files, like the app's LICENSE…]
└── script.js
…and that the following is true:
electron-packager is installed locallyproductName in package.json has been set to Foo Barelectron module is in the devDependencies section of package.json, and set to the exact version of 1.4.15.npm install for the Foo Bar app has been run at least onceWhen one runs the following command for the first time in the foobar directory:
npx electron-packager .
electron-packager will do the following:
sourcedirappname from the productName in package.jsonappVersion from the version in package.jsonplatform and arch from the host, in this example, darwin platform and x64 arch.~/.electron)Foo Bar.appFoo Bar.app in foobar/Foo Bar-darwin-x64/ (since an out directory was not specified, it used the current working directory)The file structure now looks like:
foobar
├── Foo Bar-darwin-x64
│ ├── Foo Bar.app
│ │ └── […Mac app contents…]
│ ├── LICENSE [the Electron license]
│ └── version
├── […other application bundles, like "Foo Bar-win32-x64" (sans quotes)…]
├── package.json
├── index.html
├── […other files, like the app's LICENSE…]
└── script.js
The Foo Bar.app folder generated can be executed by a system running macOS, which will start the packaged Electron app. This is also true of the Windows x64 build on a system running a new enough version of Windows for a 64-bit system (via Foo Bar-win32-x64/Foo Bar.exe), and so on.
Windows:
macOS:
Linux:
These Node modules utilize Electron Packager API hooks:
FAQs
Customize and package your Electron app with OS-specific bundles (.app, .exe, etc.) via JS or CLI
The npm package electron-packager receives a total of 91,065 weekly downloads. As such, electron-packager popularity was classified as popular.
We found that electron-packager demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.

Security News
PyPI adds Trusted Publishing support for GitLab Self-Managed as adoption reaches 25% of uploads

Research
/Security News
A malicious Chrome extension posing as an Ethereum wallet steals seed phrases by encoding them into Sui transactions, enabling full wallet takeover.