
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
The only purpose of this repository is to publish Nushell officially released binaries to the NPM registry as is, for easy installation via npm.
For issues about the nushell npm package (such as installation, format, etc.) please create an issue here, and for issues about the nu binaries please go to the Official Nushell Repo to submit an issue.
To install nu by npm, simply run: npm i -g nushell, then you can run nu to start a new session.
nu or 'No matching version found for nushell...' while installation, please specify the registry and try to install it again: npm i -g nushell --registry https://registry.npmjs.com.nushell currently contains only the nu binary, and the official plugins were not included, if you need the full version, please build it from source or download the packages from hereWhy is Nushell published to npm even? There's nothing JavaScript about Nushell (that I know of?), Isn't npm...for js packages?
The direct cause of publishing Nushell to npm was from Nushell's user feedback: "I'd like to run nu scripts in environments that only have access to npm for installing dependencies.". In fact, we have encountered many times such situation with network limitations too, and publishing to npm is a good approach, especially for a container environment that doesn't have winget or brew installed.
npm may be thought as typically for js packages, however, nowadays lots of binaries written by rust or go have been published to npm, such as git-cliff, lefthook, etc. they are all dev tools, and nushell is an engine that could power lots of develop involved scripts, and publishing it to npm will make it easier to access especially for JS related projects, as they already have npm been installed.
Will the npm version of nu I installed be bloated?
No. You can read that from the base npm package.json and the platform specific package.json, only the packages in dependencies will be installed, and the number of dependencies to be installed is 0, for optionalDependencies that means npm will choose the exact one package according to your os and cpu arch. For example, I'm using a mac with Intel cpu inside and npm will install only @nushell/darwin-x64 for me and nothing else. See? npm choose the right package for me with just one command.
Does the npm version of nu I installed have JS performance issues?
Well, you can read that from the source here. All node does is simply call the nu binary itself, and nothing more.
本仓库的唯一作用就是将 Nushell 官方发布的二进制文件原封不动地发布到 NPM 仓库,方便大家通过 npm 安装使用。
对于 nushell npm 包的问题(诸如安装、格式等)可以 在此 提 Issue,至于 nu 二进制文件的问题请前往 官方仓库 提 Issue。
通过 npm 安装 nushell 只需要执行: npm i -g nushell 即可,然后你可以通过 nu 命令创建一个新的会话。
nu 时看到 'Error: Couldn't find application binary inside node_modules...' 错误,或者在安装过程中看到 'No matching version found for nushell...' 错误,请尝试指定 registry 参数并重新安装:npm i -g nushell --registry https://registry.npmjs.com。nushell 的 npm 包内目前只包含 nu 二进制文件,不含官方提供的各插件,如需完整版本请自行通过源码构建或者 由此下载FAQs
The official release of Nushell with default features included.
The npm package nushell receives a total of 3,602 weekly downloads. As such, nushell popularity was classified as popular.
We found that nushell demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.