Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Portable Unix shell commands for Node.js, modified by mb, remove process.exit
ShellJS is a portable (Windows/Linux/OS X) implementation of Unix shell commands on top of the Node.js API. You can use it to eliminate your shell script's dependency on Unix while still keeping its familiar and powerful commands. You can also install it globally so you can run it from outside Node projects - say goodbye to those gnarly Bash scripts!
ShellJS supports node v0.11
, v0.12
, v4
, v5
, v6
, and all releases of iojs.
The project is unit-tested and battled-tested in projects like:
If you have feedback, suggestions, or need help, feel free to post in our issue tracker.
Think ShellJS is cool? Check out some related projects (like cash--a javascript-based POSIX shell) in our Wiki page!
Upgrading from an older version? Check out our breaking changes page to see what changes to watch out for while upgrading.
If you just want cross platform UNIX commands, checkout our new project
shelljs/shx, a utility to expose shelljs
to
the command line.
For example:
$ shx mkdir -p foo
$ shx touch foo/bar.txt
$ shx rm -rf foo
For documentation on all the latest features, check out our README. To read docs that are consistent with the latest release, check out the npm page or shelljs.org.
Via npm:
$ npm install [-g] shelljs
If the global option -g
is specified, the binary shjs
will be installed. This makes it possible to
run ShellJS scripts much like any shell script from the command line, i.e. without requiring a node_modules
folder:
$ shjs my_script
require('shelljs/global');
if (!which('git')) {
echo('Sorry, this script requires git');
exit(1);
}
// Copy files to release dir
rm('-rf', 'out/Release');
cp('-R', 'stuff/', 'out/Release');
// Replace macros in each .js file
cd('lib');
ls('*.js').forEach(function(file) {
sed('-i', 'BUILD_VERSION', 'v0.1.2', file);
sed('-i', /^.*REMOVE_THIS_LINE.*$/, '', file);
sed('-i', /.*REPLACE_LINE_WITH_MACRO.*\n/, cat('macro.js'), file);
});
cd('..');
// Run external tool synchronously
if (exec('git commit -am "Auto-commit"').code !== 0) {
echo('Error: Git commit failed');
exit(1);
}
CoffeeScript is also supported automatically:
require 'shelljs/global'
if not which 'git'
echo 'Sorry, this script requires git'
exit 1
# Copy files to release dir
rm '-rf', 'out/Release'
cp '-R', 'stuff/', 'out/Release'
# Replace macros in each .js file
cd 'lib'
for file in ls '*.js'
sed '-i', 'BUILD_VERSION', 'v0.1.2', file
sed '-i', /^.*REMOVE_THIS_LINE.*$/, '', file
sed '-i', /.*REPLACE_LINE_WITH_MACRO.*\n/, cat('macro.js'), file
cd '..'
# Run external tool synchronously
if (exec 'git commit -am "Auto-commit"').code != 0
echo 'Error: Git commit failed'
exit 1
The example above uses the convenience script shelljs/global
to reduce verbosity. If polluting your global namespace is not desirable, simply require shelljs
.
Example:
var shell = require('shelljs');
shell.echo('hello world');
All commands run synchronously, unless otherwise stated.
All commands accept standard bash globbing characters (*
, ?
, etc.),
compatible with the node glob module.
For less-commonly used commands and features, please check out our wiki page.
Changes to directory dir
for the duration of the script. Changes to home
directory if no argument is supplied.
Returns the current directory.
Available options:
-R
: recursive-A
: all files (include files beginning with .
, except for .
and ..
)-d
: list directories themselves, not their contents-l
: list objects representing each file, each with fields containing ls -l
output fields. See
fs.Stats
for more infoExamples:
ls('projs/*.js');
ls('-R', '/users/me', '/tmp');
ls('-R', ['/users/me', '/tmp']); // same as above
ls('-l', 'file.txt'); // { name: 'file.txt', mode: 33188, nlink: 1, ...}
Returns array of files in the given path, or in current directory if no path provided.
Examples:
find('src', 'lib');
find(['src', 'lib']); // same as above
find('.').filter(function(file) { return file.match(/\.js$/); });
Returns array of all files (however deep) in the given paths.
The main difference from ls('-R', path)
is that the resulting file names
include the base directories, e.g. lib/resources/file1
instead of just file1
.
Available options:
-f
: force (default behavior)-n
: no-clobber-r
, -R
: recursive-L
: follow symlinks-P
: don't follow symlinksExamples:
cp('file1', 'dir1');
cp('-R', 'path/to/dir/', '~/newCopy/');
cp('-Rf', '/tmp/*', '/usr/local/*', '/home/tmp');
cp('-Rf', ['/tmp/*', '/usr/local/*'], '/home/tmp'); // same as above
Copies files.
Available options:
-f
: force-r, -R
: recursiveExamples:
rm('-rf', '/tmp/*');
rm('some_file.txt', 'another_file.txt');
rm(['some_file.txt', 'another_file.txt']); // same as above
Removes files.
Available options:
-f
: force (default behavior)-n
: no-clobberExamples:
mv('-n', 'file', 'dir/');
mv('file1', 'file2', 'dir/');
mv(['file1', 'file2'], 'dir/'); // same as above
Moves files.
Available options:
-p
: full path (will create intermediate dirs if necessary)Examples:
mkdir('-p', '/tmp/a/b/c/d', '/tmp/e/f/g');
mkdir('-p', ['/tmp/a/b/c/d', '/tmp/e/f/g']); // same as above
Creates directories.
Available expression primaries:
'-b', 'path'
: true if path is a block device'-c', 'path'
: true if path is a character device'-d', 'path'
: true if path is a directory'-e', 'path'
: true if path exists'-f', 'path'
: true if path is a regular file'-L', 'path'
: true if path is a symbolic link'-p', 'path'
: true if path is a pipe (FIFO)'-S', 'path'
: true if path is a socketExamples:
if (test('-d', path)) { /* do something with dir */ };
if (!test('-f', path)) continue; // skip if it's a regular file
Evaluates expression using the available primaries and returns corresponding value.
Examples:
var str = cat('file*.txt');
var str = cat('file1', 'file2');
var str = cat(['file1', 'file2']); // same as above
Returns a string containing the given file, or a concatenated string containing the files if more than one file is given (a new line character is introduced between each file).
Examples:
var str = head({'-n', 1}, 'file*.txt');
var str = head('file1', 'file2');
var str = head(['file1', 'file2']); // same as above
Output the first 10 lines of a file (or the first <num>
if -n
is
specified)
Examples:
var str = tail({'-n', 1}, 'file*.txt');
var str = tail('file1', 'file2');
var str = tail(['file1', 'file2']); // same as above
Output the last 10 lines of a file (or the last <num>
if -n
is
specified)
Examples:
cat('input.txt').to('output.txt');
Analogous to the redirection operator >
in Unix, but works with
ShellStrings (such as those returned by cat
, grep
, etc). Like Unix
redirections, to()
will overwrite any existing file!
Examples:
cat('input.txt').toEnd('output.txt');
Analogous to the redirect-and-append operator >>
in Unix, but works with
ShellStrings (such as those returned by cat
, grep
, etc).
Available options:
-i
: Replace contents of 'file' in-place. Note that no backups will be created!Examples:
sed('-i', 'PROGRAM_VERSION', 'v0.1.3', 'source.js');
sed(/.*DELETE_THIS_LINE.*\n/, '', 'source.js');
Reads an input string from files
and performs a JavaScript replace()
on the input
using the given search regex and replacement string or function. Returns the new string after replacement.
Available options:
-r
: Reverse the result of comparisons-n
: Compare according to numerical valueExamples:
sort('foo.txt', 'bar.txt');
sort('-r', 'foo.txt');
Return the contents of the files, sorted line-by-line. Sorting multiple files mixes their content, just like unix sort does.
Available options:
-v
: Inverse the sense of the regex and print the lines not matching the criteria.-l
: Print only filenames of matching filesExamples:
grep('-v', 'GLOBAL_VARIABLE', '*.js');
grep('GLOBAL_VARIABLE', '*.js');
Reads input string from given files and returns a string containing all lines of the
file that match the given regex_filter
.
Examples:
var nodeExec = which('node');
Searches for command
in the system's PATH. On Windows, this uses the
PATHEXT
variable to append the extension if it's not already executable.
Returns string containing the absolute path to the command.
Examples:
echo('hello world');
var str = echo('hello world');
Prints string to stdout, and returns string with additional utility methods
like .to()
.
Available options:
-n
: Suppresses the normal change of directory when adding directories to the stack, so that only the stack is manipulated.Arguments:
dir
: Makes the current working directory be the top of the stack, and then executes the equivalent of cd dir
.+N
: Brings the Nth directory (counting from the left of the list printed by dirs, starting with zero) to the top of the list by rotating the stack.-N
: Brings the Nth directory (counting from the right of the list printed by dirs, starting with zero) to the top of the list by rotating the stack.Examples:
// process.cwd() === '/usr'
pushd('/etc'); // Returns /etc /usr
pushd('+1'); // Returns /usr /etc
Save the current directory on the top of the directory stack and then cd to dir
. With no arguments, pushd exchanges the top two directories. Returns an array of paths in the stack.
Available options:
-n
: Suppresses the normal change of directory when removing directories from the stack, so that only the stack is manipulated.Arguments:
+N
: Removes the Nth directory (counting from the left of the list printed by dirs), starting with zero.-N
: Removes the Nth directory (counting from the right of the list printed by dirs), starting with zero.Examples:
echo(process.cwd()); // '/usr'
pushd('/etc'); // '/etc /usr'
echo(process.cwd()); // '/etc'
popd(); // '/usr'
echo(process.cwd()); // '/usr'
When no arguments are given, popd removes the top directory from the stack and performs a cd to the new top directory. The elements are numbered from 0 starting at the first directory listed with dirs; i.e., popd is equivalent to popd +0. Returns an array of paths in the stack.
Available options:
-c
: Clears the directory stack by deleting all of the elements.Arguments:
+N
: Displays the Nth directory (counting from the left of the list printed by dirs when invoked without options), starting with zero.-N
: Displays the Nth directory (counting from the right of the list printed by dirs when invoked without options), starting with zero.Display the list of currently remembered directories. Returns an array of paths in the stack, or a single path if +N or -N was specified.
See also: pushd, popd
Available options:
-s
: symlink-f
: forceExamples:
ln('file', 'newlink');
ln('-sf', 'file', 'existing');
Links source to dest. Use -f to force the link, should dest already exist.
Exits the current process with the given exit code.
Object containing environment variables (both getter and setter). Shortcut to process.env.
Available options (all false
by default):
async
: Asynchronous execution. If a callback is provided, it will be set to
true
, regardless of the passed value.silent
: Do not echo program output to console.Examples:
var version = exec('node --version', {silent:true}).stdout;
var child = exec('some_long_running_process', {async:true});
child.stdout.on('data', function(data) {
/* ... do something with data ... */
});
exec('some_long_running_process', function(code, stdout, stderr) {
console.log('Exit code:', code);
console.log('Program output:', stdout);
console.log('Program stderr:', stderr);
});
Executes the given command
synchronously, unless otherwise specified. When in synchronous
mode, this returns a ShellString (compatible with ShellJS v0.6.x, which returns an object
of the form { code:..., stdout:... , stderr:... }
). Otherwise, this returns the child process
object, and the callback
gets the arguments (code, stdout, stderr)
.
Not seeing the behavior you want? exec()
runs everything through sh
by default (or cmd.exe
on Windows), which differs from bash
. If you
need bash-specific behavior, try out the {shell: 'path/to/bash'}
option.
Note: For long-lived processes, it's best to run exec()
asynchronously as
the current synchronous implementation uses a lot of CPU. This should be getting
fixed soon.
Available options:
-v
: output a diagnostic for every file processed-c
: like verbose but report only when a change is made-R
: change files and directories recursivelyExamples:
chmod(755, '/Users/brandon');
chmod('755', '/Users/brandon'); // same as above
chmod('u+x', '/Users/brandon');
Alters the permissions of a file or directory by either specifying the absolute permissions in octal form or expressing the changes in symbols. This command tries to mimic the POSIX behavior as much as possible. Notable exceptions:
Available options:
-a
: Change only the access time-c
: Do not create any files-m
: Change only the modification time-d DATE
: Parse DATE and use it instead of current time-r FILE
: Use FILE's times instead of current timeExamples:
touch('source.js');
touch('-c', '/path/to/some/dir/source.js');
touch({ '-r': FILE }, '/path/to/some/dir/source.js');
Update the access and modification times of each FILE to the current time. A FILE argument that does not exist is created empty, unless -c is supplied. This is a partial implementation of touch(1).
Available options:
+/-e
: exit upon error (config.fatal
)+/-v
: verbose: show all commands (config.verbose
)+/-f
: disable filename expansion (globbing)Examples:
set('-e'); // exit upon first error
set('+e'); // this undoes a "set('-e')"
Sets global configuration variables
Examples:
var tmp = tempdir(); // "/tmp" for most *nix platforms
Searches and returns string containing a writeable, platform-dependent temporary directory. Follows Python's tempfile algorithm.
Tests if error occurred in the last command. Returns a truthy value if an error returned and a falsy value otherwise.
Note: do not rely on the
return value to be an error message. If you need the last error message, use
the .stderr
attribute from the last command's return value instead.
Examples:
var foo = ShellString('hello world');
Turns a regular string into a string-like object similar to what each
command returns. This has special methods, like .to()
and .toEnd()
Examples:
grep('foo', 'file1.txt', 'file2.txt').sed(/o/g, 'a').to('output.txt');
echo('files with o\'s in the name:\n' + ls().grep('o'));
cat('test.js').exec('node'); // pipe to exec() call
Commands can send their output to another command in a pipe-like fashion.
sed
, grep
, cat
, exec
, to
, and toEnd
can appear on the right-hand
side of a pipe. Pipes can be chained.
Example:
var sh = require('shelljs');
var silentState = sh.config.silent; // save old silent state
sh.config.silent = true;
/* ... */
sh.config.silent = silentState; // restore old silent state
Suppresses all command output if true
, except for echo()
calls.
Default is false
.
Example:
require('shelljs/global');
config.fatal = true; // or set('-e');
cp('this_file_does_not_exist', '/dev/null'); // throws Error here
/* more commands... */
If true
the script will throw a Javascript error when any shell.js
command encounters an error. Default is false
. This is analogous to
Bash's set -e
Example:
config.verbose = true; // or set('-v');
cd('dir/');
ls('subdir/');
Will print each command as follows:
cd dir/
ls subdir/
Example:
config.globOptions = {nodir: true};
Use this value for calls to glob.sync()
instead of the default options.
Nate Fischer | Ari Porad |
FAQs
Portable Unix shell commands for Node.js, modified by mb, remove process.exit
We found that mb-shelljs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.