
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
j-shellscript
Advanced tools
Use shell commands directly from nodejs to make synchronous shell scripts.
Use shell commands directly from nodejs, nice and synchronous, so you can build easy command line scripts in node much like in Ruby.
So much like Ruby in fact, that here are the samples in coffeescript first.
require('shellscript').globalize()
shell "ls ."
And pipelines...
require('shellscript').globalize()
shell "ls . | grep lib"
Or if you us just plain Javascript
require('shellscript').globalize()
shell("ls .");
And of course, you can subshell and capture output
require('shellscript').globalize()
stuff = $("ls .")
Puts shellscript's functions on global, so you can call them without an intermediate variable or namespace, useful to make this feel a lot more like other languages with built in synchronous shelling.
This just runs a command using your current $SHELL or /bin/sh if not
set. It pipes stdout and stderr into the parent, and blocks until
complete. This is the workhorse make a shell script function.
If exitOnError is true, this will exit the process for any non 0 exit
code. Handy if you just want to exit and avoid error checking the return
object.
An object with properties:
Much like shell above, but instead of returning process information,
returns the string that is stdout, or empty for a non-zero exit code.
In this version, if you pass args, either as a CoffeeScript splat or JavaScript array, the command will be invoked directly without a subshell. This is a tiny bit faster, and sometimes what you need if you don't want to run a shell pipeline.
FAQs
Use shell commands directly from nodejs to make synchronous shell scripts.
The npm package j-shellscript receives a total of 3 weekly downloads. As such, j-shellscript popularity was classified as not popular.
We found that j-shellscript demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.