
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
npm-run-batch
Advanced tools
npm run-script helper that allows running a bunch of run-scripts - in series or parallel!
npm run-script helper that allows running multiple run-scripts in series & parallel
npm-run-batch allows npm to be used as a build tool with a minimum of fuss.
It's not uncommon to see npm run-scripts that look like this:
"prebuild": "npm run build:clean && npm run test",
"build": "cross-env NODE_ENV=production webpack --config internals/webpack/webpack.prod.babel.js --color -p",
"build:clean": "npm run test:clean && rimraf ./build",
"build:dll": "node ./internals/scripts/dependencies.js",
As project complexity grows, these become harder to comprehend and debug.
To tackle this (and other things, but I never claim impartiality!), multiple build/automation tools have been craated gulp, grunt, brunch and that is not even the whole list.
However, this is not without debate.
A persistent source of complexity with using npm as a build tool are the pesky && to chain commands together. Further, one cannot run multiple commands in parallel. Here's a good example why that can be necessary.
npm-run-batch attempts to solve the problem of composing complex automation flows for npm-as-a-build-tool.
It provides simple semantics, aids clarity and requires almost no extra installed weight.
"scripts": {
"rimraf": "rimraf ./build",
"webpack": "webpack --config internals/webpack/webpack.prod.bable.js --color -p",
"build:dll": "node ./internals/scripts/dependencies.js",
"test": "mocha",
"build:clean": "npm-run-batch",
"build": "cross-env NODE_ENV=production npm-run-batch"
},
"run-batch": {
"build:clean": [
"test:clean",
"rimraf"
],
"build": [
"build:clean",
"test",
"webpack"
]
}
npm install npm-run-batch
The module exposes two binary aliases -
npm-run-batch
run-batch
These are meant to be invoked from npm-run scripts and used for the grouping of batch sequences as we shall see next.
In your package.json, define tasks as usual, but they do only one thing. The batch operations are the ones that are the meat of your run-script.
"scripts": {
"task:1": "a simple task",
"task:2": "a simple task",
"task:3": "a simple task",
"task:4": "a simple task",
"batch:1": "run-batch",
"batch:2": "run-batch"
}
Once the batch tasks have been tagged (either of the aliases will work),
Add a "run-batch" segment to your package.json
For each batch run-script, add a key to the "run-batch" section.
Each "run-batch" segment is a list of run-scripts that you want to run.
At each stage, run-scripts can be run in parallel if you add an array as shown for
"batch:2" below.
"run-batch": { "batch:1": [ "task:1", "task:2" ], "batch:2": [ "task:1", [ "task:2", "task:3" ], // Parallel tasks "task:4" ] }
Importantly, we allow for both aliases to be used interchangeably. If both aliases are present
in package.json for batching, "run-batch" takes precedence over "npm-run-batch".
That's all there is to it!
Please see package.json for a few working examples. Because we can't install the package within itself, instead of the alias run-batch, we use node ./index.js. With that caveat, this should work as described.
Feedback of all kinds is welcome.
Apache-2.0
FAQs
npm run-script helper that allows running a bunch of run-scripts - in series or parallel!
The npm package npm-run-batch receives a total of 1,843 weekly downloads. As such, npm-run-batch popularity was classified as popular.
We found that npm-run-batch demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.