Security News
pnpm 10.0.0 Blocks Lifecycle Scripts by Default
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
NodeJS package that gives a simplier API to npm install (programatically installs things)
npm@^2
npm@^3
npm@^5
global-npm
(meaning npm
is no longer a dependency of npmi
):warning: Be advised that
npm
in itsv5+
will symlink local modules from the destination directory to the actual module directory instead of "installing" them old-school style (which is a breaking change regarding the previous npm versions)
Type: String
Optional: true
If you don't specify a name
in options, but just a path
, npmi will do the same as if you were at this path in a terminal and executing npm install
Otherwise, it will install the module specified by this name like npm install module-name
does.
Type: String
Optional: true
Default 'latest'
Desired version for installation
Type: String
Optional: true
Default '.'
Desired location for installation (note that if you specified /some/foo/path, npm will automatically create a node_modules
sub-folder at this location, resulting in /some/foo/path/node_modules
). So don't specify the node_modules
part in your path
Type: Boolean
Optional: true
Default false
If true, npmi will install options.name
module even though it has already been installed.
If false, npmi will check if the module is already installed, if it is, it will also check if the installed version is equal to options.version
, otherwise, it will install options.name@options.version
Type: Boolean
Optional: true
Default false
Allows npmi to install local module that are not on npm registry. If, you want to install a local module by specifying its full path in options.name
, you need to set this to true
.
Type: Object
Optional: true
Default {loglevel: 'silent'}
This object is given to npm and allows you to do some fine-grained npm configurations.
It is processed by npm like command-line arguments but within an Object map (npm-config)
var npmi = require('npmi');
var path = require('path');
console.log(npmi.NPM_VERSION); // prints the installed npm version used by npmi
var options = {
name: 'your-module', // your module name
version: '0.0.1', // expected version [default: 'latest']
path: '.', // installation path [default: '.']
forceInstall: false, // force install if set to true (even if already installed, it will do a reinstall) [default: false]
npmLoad: { // npm.load(options, callback): this is the "options" given to npm.load()
loglevel: 'silent' // [default: {loglevel: 'silent'}]
}
};
npmi(options, function (err, result) {
if (err) {
if (err.code === npmi.LOAD_ERR) console.log('npm load error');
else if (err.code === npmi.INSTALL_ERR) console.log('npm install error');
return console.log(err.message);
}
// installed
console.log(options.name+'@'+options.version+' installed successfully in '+path.resolve(options.path));
});
This work has been done in the context of the HEADS Project
FAQs
Gives a simplier API to npm install (programatically installs stuffs)
The npm package npmi receives a total of 14,892 weekly downloads. As such, npmi popularity was classified as popular.
We found that npmi demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.
Research
Security News
Socket researchers have discovered multiple malicious npm packages targeting Solana private keys, abusing Gmail to exfiltrate the data and drain Solana wallets.