
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
future-root-path
Advanced tools
Please Note: Due to the very limited scope of this module, I do not anticipate needing to make very many changes to it. Expect long stretches of zero updates—that does not mean that the module is outdated.
This simple module helps you access your application's root path from anywhere in the application without resorting to relative paths like require("../../path").
$ npm install app-root-path --save
To simply access the app's root path, use the module as though it were a string:
var appRoot = require('app-root-path');
var myModule = require(appRoot + '/lib/my-module.js');
Side note: the module actually returns an object, but that object implements the
toStringmethod, so you can use it as though it were a string. There are a few edge cases where this might not be the case (most notablyconsole.log), but they shouldn't affect actual use of the module, where you're almost always concatenating with an additional string.
A helper function is also provided:
var reqlib = require('app-root-path').require;
var myModule = reqlib('/lib/my-module.js');
It's a little hacky, but you can also put this method on your application's global object to use it everywhere in your project:
// In app.js
global.reqlib = require('app-root-path').require;
// In lib/module/component/subcomponent.js
var myModule = reqlib('/lib/my-module.js');
Finally, you can also just resolve a module path:
var myModulePath = require('app-root-path').resolve('/lib/my-module.js');
You can explicitly set the path, using the environmental variable APP_ROOT_PATH or by calling require('app-root-path').setPath('/my/app/is/here')
No need to read this unless your curious—or you run into a (very unlikely) case where the module does not work as expected.
This module uses two different methods to determine the app's root path, depending on the circumstances.
If the module is located inside your project's directory, somewhere within the node_modules directory (whether directly, or inside a submodule), we effectively do (the actual code takes cross-platform path names/etc into consideration):
path.resolve(__dirname).split('/node_modules')[0];
This will take a path like /var/www/node_modules/submodule/node_modules/app-root-path and return /var/www. In nearly all cases, this is just what you need.
The node module loader will also look in a few other places for modules (for example, ones that you install globally with npm install -g). These can be in one of:
$HOME/.node_modules$HOME/.node_libraries$PREFIX/lib/nodeOr, anywhere in the NODE_PATH environmental variable (see documentation).
In these cases, we fall back to an alternate trick:
path.dirname(require.main.filename);
When a file is run directly from Node, require.main is set to that file's module. Each module has a filename property that refers to the filename of that module, so by fetching the directory name for that file, we at least get the directory of file passed to node. In some cases (process managers and test suites, for example) this doesn't actually give the correct directory, though, so this method is only used as a fallback.
require() method to the appRootPath.require() function. Which it's true that each module has its own require() method, in practice it doesn't matter, and it's much simpler this way.FAQs
Determine an app's root path from anywhere inside the app
We found that future-root-path demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.