
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
package-manager-detector
Advanced tools
Package manager detector is based on lock files, the package.json
packageManager
field, and installation metadata to detect the package manager used in a project.
It supports npm
, yarn
, pnpm
, deno
, and bun
.
# pnpm
pnpm add package-manager-detector
# npm
npm i package-manager-detector
# yarn
yarn add package-manager-detector
To check the file system for which package manager is used:
import { detect } from 'package-manager-detector/detect'
or to get the currently running package manager:
import { getUserAgent } from 'package-manager-detector/detect'
By default, the detect
API searches through the current directory for lock files, and if none exists, it looks for the packageManager
field in package.json
. If that also doesn't exist, it will check the devEngines.packageManager
field in package.json
. If all strategies couldn't detect the package manager, it'll crawl upwards to the parent directory and repeat the detection process until it reaches the root directory.
The strategies can be configured through detect
's strategies
option with the following accepted strategies:
'lockfile'
: Look up for lock files.'packageManager-field'
: Look up for the packageManager
field in package.json.'devEngines-field'
: Look up for the devEngines.packageManager
field in package.json.'install-metadata'
: Look up for installation metadata added by package managers.The order of the strategies can also be changed to prioritize one strategy over another. For example, if you prefer to detect the package manager used for installation:
import { detect } from 'package-manager-detector/detect'
const pm = await detect({
strategies: ['install-metadata', 'lockfile', 'packageManager-field', 'devEngines-field']
})
This package includes package manager agents and their corresponding commands for:
'agent'
- run the package manager with no arguments'install'
- install dependencies'frozen'
- install dependencies using frozen lockfile'add'
- add dependencies'uninstall'
- remove dependencies'global'
- install global packages'global_uninstall'
- remove global packages'upgrade'
- upgrade dependencies'upgrade-interactive'
- upgrade dependencies interactively: not available for npm
and bun
'execute'
- download & execute binary scripts'execute-local'
- execute binary scripts (from package locally installed)'run'
- run package.json
scriptsA resolveCommand
function is provided to resolve the command for a specific agent.
import { resolveCommand } from 'package-manager-detector/commands'
import { detect } from 'package-manager-detector/detect'
const pm = await detect()
if (!pm)
throw new Error('Could not detect package manager')
const { command, args } = resolveCommand(pm.agent, 'add', ['@antfu/ni']) // { command: 'pnpm', args: ['add', '@antfu/ni'] }
console.log(`Detected the ${pm.agent} package manager. You can run a install with ${command} ${args.join(' ')}`)
You can check the source code or the JSDocs for more information.
MIT License © 2020-PRESENT Anthony Fu
FAQs
Package manager detector
The npm package package-manager-detector receives a total of 2,628,391 weekly downloads. As such, package-manager-detector popularity was classified as popular.
We found that package-manager-detector demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.