
Security News
OpenClaw Advisory Surge Highlights Gaps Between GHSA and CVE Tracking
A recent burst of security disclosures in the OpenClaw project is drawing attention to how vulnerability information flows across advisory and CVE systems.
Open stuff like URLs, files, executables. Cross-platform.
If need this for Electron, use shell.openItem() instead.
Note: The original open package was recently deprecated in favor of this package, and we got the name, so this package is now named open instead of opn. If you're upgrading from the original open package (open@0.0.5 or lower), keep in mind that the API is different.
spawn instead of exec.node-open issues.xdg-open script for Linux./mnt/*.$ npm install open
const open = require('open');
(async () => {
// Opens the image in the default image viewer and waits for the opened app to quit
await open('unicorn.png', {wait: true});
console.log('The image viewer app quit');
// Opens the URL in the default browser
await open('https://sindresorhus.com');
// Opens the URL in a specified browser
await open('https://sindresorhus.com', {app: 'firefox'});
// Specify app arguments
await open('https://sindresorhus.com', {app: ['google chrome', '--incognito']});
})();
It uses the command open on macOS, start on Windows and xdg-open on other platforms.
Returns a promise for the spawned child process. You would normally not need to use this for anything, but it can be useful if you'd like to attach custom event listeners or perform other operations directly on the spawned process.
Type: string
The thing you want to open. Can be a URL, file, or executable.
Opens in the default app for the file type. For example, URLs opens in your default browser.
Type: object
Type: boolean
Default: false
Wait for the opened app to exit before fulfilling the promise. If false it's fulfilled immediately when opening the app.
Note that it waits for the app to exit, not just for the window to close.
On Windows, you have to explicitly specify an app for it to be able to wait.
Type: boolean
Default: false
Do not bring the app to the foreground.
Type: string | string[]
Specify the app to open the target with, or an array with the app and app arguments.
The app name is platform dependent. Don't hard code it in reusable modules. For example, Chrome is google chrome on macOS, google-chrome on Linux and chrome on Windows.
You may also pass in the app's full path. For example on WSL, this can be /mnt/c/Program Files (x86)/Google/Chrome/Application/chrome.exe for the Windows installation of Chrome.
The 'opn' package was the predecessor to 'open' and has since been deprecated in favor of 'open'. It offered similar functionality to open resources with the default application or a specified one.
While 'execa' is more of a process execution tool than a direct alternative to 'open', it can be used to achieve similar results by running system commands to open files or URLs with specific applications.
The 'start' package is another alternative that can open files or URLs using the default application. It is less feature-rich compared to 'open' and is specific to Windows.
FAQs
Open stuff like URLs, files, executables. Cross-platform.
The npm package open receives a total of 54,826,669 weekly downloads. As such, open popularity was classified as popular.
We found that open demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
A recent burst of security disclosures in the OpenClaw project is drawing attention to how vulnerability information flows across advisory and CVE systems.

Research
/Security News
Mixed-script homoglyphs and a lookalike domain mimic imToken’s import flow to capture mnemonics and private keys.

Security News
Latio’s 2026 report recognizes Socket as a Supply Chain Innovator and highlights our work in 0-day malware detection, SCA, and auto-patching.