
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
native-run
Advanced tools
native-run is a cross-platform command-line utility for running native app binaries (.ipa and .apk files) on iOS and Android devices. It can be used for both hardware and virtual devices.
This tool is used by the Ionic CLI, but it can be used standalone as part of a development or testing pipeline for launching apps. It doesn't matter whether the .apk or .ipa is created with Cordova or native IDEs, native-run will be able to deploy it.
native-run is written entirely in TypeScript/NodeJS, so there are no native dependencies.
To install, run:
npm install -g native-run
:memo: Requires NodeJS 16+
native-run <platform> [options]
See the help documentation with the --help flag.
native-run --help
native-run ios --help
native-run android --help
Much more information can be printed to the screen with the --verbose flag.
The adb (Android Debug Bridge) package is a versatile command-line tool that lets you communicate with a device. It offers more granular control over Android devices compared to native-run, including installing and debugging apps, accessing a Unix shell, and more.
The ios-deploy package is a command-line utility for deploying iOS apps to physical devices. It is similar to native-run but focuses solely on iOS, providing functionalities like installing and launching apps on iOS devices.
The expo-cli package is a command-line tool for developing and building React Native apps. While it offers broader functionalities for app development, it also includes features for running apps on both iOS and Android devices, similar to native-run.
FAQs
A CLI for running apps on iOS/Android devices and simulators/emulators
The npm package native-run receives a total of 1,634,023 weekly downloads. As such, native-run popularity was classified as popular.
We found that native-run demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 24 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.