
Research
/Security News
PolinRider Spreads Through Compromised GitHub Accounts and Packagist
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.
pear-install
Advanced tools
Install Pear and Pear Applications
The published binary. With no link, installs the Pear platform. With a pear:// link, installs that application and/or its binaries.
npx pear-install [link]
--to <dir> — target directory (overrides platform default)--only <paths> — comma-separated filenames to install--timeout <seconds> — network timeout (default 30)--dht-bootstrap <nodes> — comma-separated host:port--json — newline-delimited JSON output (one { cmd: 'install', tag, data } per line)/Applications, bins to /usr/local/bin~/Applications, ~/AppImages, or ~/.local/bin; bins to ~/.local/bin.exe) to %LOCALAPPDATA%\Programs\<app>\ with the install directory added to the User PATHconst Install = require('pear-install')
const install = new Install(opts)link (string) — pear:// linkto (string, optional) — target directoryonly (string, optional) — comma-separated filenamesbootstrap (array, optional) — [{ host, port }, ...] DHT nodestimeout (number, optional) — milliseconds, default 30000corestore (Corestore, optional) — inject an existing corestore; not closed by install.close()swarm (Hyperswarm, optional) — inject an existing swarm; not destroyed by install.close()If corestore or swarm is omitted, Install creates and owns its own.
await install.ready()Runs the install. Throws on failure.
await install.close()Releases the drive, the owned swarm and corestore, and removes the temp dir.
const corestore = new Corestore('./store')
const swarm = new Hyperswarm()
swarm.on('connection', (c) => corestore.replicate(c))
for (const link of links) {
const install = new Install({ link, corestore, swarm })
await install.ready()
await install.close()
}
await swarm.destroy()
await corestore.close()
installing → { link, host }app → { app, name, version, upgrade, verlink, key, dest }stats → { download, upload, peers }path → { dir } — Windows only; emitted when a bin directory is appended to the User PATHfinal → { success, installed, exists }/cmdFor embedding in another CLI. Wraps Install as a pear-opstream of { tag, data } records with stdout formatters.
const InstallCmd = require('pear-install/cmd')
const stream = new InstallCmd({ link, to, only, bootstrap, timeout })
await InstallCmd.output(json, stream)
installing → { link, host }app → { app, name, version, upgrade, verlink, key, dest }stats → { download, upload, peers }path → { dir } — Windows onlyerror → { code, message, stack, info, success: false }final → { success, installed, exists }await InstallCmd.output(json, stream)Drains stream to STDOUT.
json truthy — emits each record as { cmd: 'install', tag, data }, newline-delimited.json falsy — formats per-tag; stats updates in place via ANSI; static tags stack above.Returns the final record.
await InstallCmd.runner(cmd)Pass directly as a paparam command runner. Creates InstallCmd instance and passes it to InstallCmd.output
cmd is a paparam cmd instanceApache-2.0
FAQs
Install Pear and Pear Applications
The npm package pear-install receives a total of 473 weekly downloads. As such, pear-install popularity was classified as not popular.
We found that pear-install demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

Company News
Allow myself to introduce... myself.