
Research
Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.
npm-run-path
Advanced tools
Get your PATH prepended with locally installed binaries
In npm run scripts you can execute locally installed binaries by name. This enables the same outside npm.
npm install npm-run-path
import childProcess from 'node:child_process';
import {npmRunPath, npmRunPathEnv} from 'npm-run-path';
console.log(process.env.PATH);
//=> '/usr/local/bin'
console.log(npmRunPath());
//=> '/Users/sindresorhus/dev/foo/node_modules/.bin:/Users/sindresorhus/dev/node_modules/.bin:/Users/sindresorhus/node_modules/.bin:/Users/node_modules/.bin:/node_modules/.bin:/usr/local/bin'
// `foo` is a locally installed binary
childProcess.execFileSync('foo', {
env: npmRunPathEnv()
});
options: Options
Returns: string
Returns the augmented PATH string.
options: Options
Returns: object
Returns the augmented process.env object.
Type: object
Type: string | URL
Default: process.cwd()
The working directory.
Type: string | URL
Default: process.execPath
The path to the current Node.js executable.
This can be either an absolute path or a path relative to the cwd option.
Type: boolean
Default: true
Whether to push the current Node.js executable's directory (execPath option) to the front of PATH.
Type: boolean
Default: true
Whether to push the locally installed binaries' directory to the front of PATH.
Type: string
Default: PATH
The PATH to be appended.
Set it to an empty string to exclude the default PATH.
Only available with npmRunPath(), not npmRunPathEnv().
Type: object
Default: process.env
Accepts an object of environment variables, like process.env, and modifies the PATH using the correct PATH key. Use this if you're modifying the PATH for use in the child_process options.
Only available with npmRunPathEnv(), not npmRunPath().
cross-env is a package that allows you to set environment variables across platforms. It's similar to npm-run-path in that it helps with environment configuration for npm scripts, but it focuses on cross-platform compatibility rather than enhancing the PATH variable.
env-cmd is a package that allows you to execute commands using an environment from an env file. It is similar to npm-run-path in that it manipulates the environment for running scripts, but it does so by reading environment variables from files rather than modifying the PATH.
path-key is a simple package that returns the environment variable name for the PATH, which is platform-specific. It is related to npm-run-path in the sense that it deals with the PATH environment variable, but it does not enhance or modify the PATH itself.
FAQs
Get your PATH prepended with locally installed binaries
The npm package npm-run-path receives a total of 71,371,918 weekly downloads. As such, npm-run-path popularity was classified as popular.
We found that npm-run-path demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.

Product
Explore exportable charts for vulnerabilities, dependencies, and usage with Reports, Socket’s new extensible reporting framework.

Product
Socket for Jira lets teams turn alerts into Jira tickets with manual creation, automated ticketing rules, and two-way sync.