Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
npm-run-path
Advanced tools
The npm-run-path package is used to enhance the PATH environment variable with all the node_modules/.bin directories from the current directory up to the root. This allows you to run locally installed executables in your npm scripts without having to specify the full path to them.
Enhance PATH for local binaries
This feature allows you to get an enhanced PATH that includes paths to the locally installed npm binaries, making it easier to run them in scripts.
const npmRunPath = require('npm-run-path');
console.log(npmRunPath()); // Logs the enhanced PATH string
Get an environment object with an enhanced PATH
This feature provides an environment object similar to process.env but with the PATH property modified to include local binaries.
const npmRunPath = require('npm-run-path');
const env = npmRunPath.env();
console.log(env.PATH); // Logs the enhanced PATH within the environment object
Customize the PATH enhancement
This feature allows you to customize how the PATH is enhanced by providing options such as the current working directory and an existing PATH to modify.
const npmRunPath = require('npm-run-path');
const options = { cwd: '/some/path', path: process.env.PATH };
const env = npmRunPath.env(options);
console.log(env.PATH); // Logs the enhanced PATH based on the options provided
cross-env is a package that allows you to set environment variables across platforms. It's similar to npm-run-path in that it helps with environment configuration for npm scripts, but it focuses on cross-platform compatibility rather than enhancing the PATH variable.
env-cmd is a package that allows you to execute commands using an environment from an env file. It is similar to npm-run-path in that it manipulates the environment for running scripts, but it does so by reading environment variables from files rather than modifying the PATH.
path-key is a simple package that returns the environment variable name for the PATH, which is platform-specific. It is related to npm-run-path in the sense that it deals with the PATH environment variable, but it does not enhance or modify the PATH itself.
Get your PATH prepended with locally installed binaries
In npm run scripts you can execute locally installed binaries by name. This enables the same outside npm.
npm install npm-run-path
import childProcess from 'node:child_process';
import {npmRunPath, npmRunPathEnv} from 'npm-run-path';
console.log(process.env.PATH);
//=> '/usr/local/bin'
console.log(npmRunPath());
//=> '/Users/sindresorhus/dev/foo/node_modules/.bin:/Users/sindresorhus/dev/node_modules/.bin:/Users/sindresorhus/node_modules/.bin:/Users/node_modules/.bin:/node_modules/.bin:/usr/local/bin'
// `foo` is a locally installed binary
childProcess.execFileSync('foo', {
env: npmRunPathEnv()
});
options
: Options
Returns: string
Returns the augmented PATH string.
options
: Options
Returns: object
Returns the augmented process.env
object.
Type: object
Type: string | URL
Default: process.cwd()
The working directory.
Type: string | URL
Default: process.execPath
The path to the current Node.js executable.
This can be either an absolute path or a path relative to the cwd
option.
Type: boolean
Default: true
Whether to push the current Node.js executable's directory (execPath
option) to the front of PATH.
Type: boolean
Default: true
Whether to push the locally installed binaries' directory to the front of PATH.
Type: string
Default: PATH
The PATH to be appended.
Set it to an empty string to exclude the default PATH.
Only available with npmRunPath()
, not npmRunPathEnv()
.
Type: object
Default: process.env
Accepts an object of environment variables, like process.env
, and modifies the PATH using the correct PATH key. Use this if you're modifying the PATH for use in the child_process
options.
Only available with npmRunPathEnv()
, not npmRunPath()
.
FAQs
Get your PATH prepended with locally installed binaries
We found that npm-run-path demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.