Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
npm-run-path
Advanced tools
The npm-run-path package is used to enhance the PATH environment variable with all the node_modules/.bin directories from the current directory up to the root. This allows you to run locally installed executables in your npm scripts without having to specify the full path to them.
Enhance PATH for local binaries
This feature allows you to get an enhanced PATH that includes paths to the locally installed npm binaries, making it easier to run them in scripts.
const npmRunPath = require('npm-run-path');
console.log(npmRunPath()); // Logs the enhanced PATH string
Get an environment object with an enhanced PATH
This feature provides an environment object similar to process.env but with the PATH property modified to include local binaries.
const npmRunPath = require('npm-run-path');
const env = npmRunPath.env();
console.log(env.PATH); // Logs the enhanced PATH within the environment object
Customize the PATH enhancement
This feature allows you to customize how the PATH is enhanced by providing options such as the current working directory and an existing PATH to modify.
const npmRunPath = require('npm-run-path');
const options = { cwd: '/some/path', path: process.env.PATH };
const env = npmRunPath.env(options);
console.log(env.PATH); // Logs the enhanced PATH based on the options provided
cross-env is a package that allows you to set environment variables across platforms. It's similar to npm-run-path in that it helps with environment configuration for npm scripts, but it focuses on cross-platform compatibility rather than enhancing the PATH variable.
env-cmd is a package that allows you to execute commands using an environment from an env file. It is similar to npm-run-path in that it manipulates the environment for running scripts, but it does so by reading environment variables from files rather than modifying the PATH.
path-key is a simple package that returns the environment variable name for the PATH, which is platform-specific. It is related to npm-run-path in the sense that it deals with the PATH environment variable, but it does not enhance or modify the PATH itself.
Get your PATH prepended with locally installed binaries
In npm run scripts you can execute locally installed binaries by name. This enables the same outside npm.
$ npm install --save npm-run-path
const childProcess = require('child_process');
const npmRunPath = require('npm-run-path');
console.log(process.env.PATH);
//=> '/usr/local/bin'
console.log(npmRunPath());
//=> '/Users/sindresorhus/dev/foo/node_modules/.bin:/Users/sindresorhus/dev/node_modules/.bin:/Users/sindresorhus/node_modules/.bin:/Users/node_modules/.bin:/node_modules/.bin:/usr/local/bin'
// `foo` is a locally installed binary
childProcess.execFileSync('foo', {
env: npmRunPath.env()
});
Type: string
Default: process.cwd()
Working directory.
Type: string
Default: PATH
PATH to be appended.
Set it to an empty string to exclude the default PATH.
Type: string
Default: process.cwd()
Working directory.
Type: Object
Accepts an object of environment variables, like process.env
, and modifies the PATH using the correct PATH key. Use this if you're modifying the PATH for use in the child_process
options.
MIT © Sindre Sorhus
FAQs
Get your PATH prepended with locally installed binaries
The npm package npm-run-path receives a total of 67,073,763 weekly downloads. As such, npm-run-path popularity was classified as popular.
We found that npm-run-path demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.