
Security News
Anthropic Identifies Biased Reasoning and Recklessness as Drivers of Claude’s PyPI Attack
Anthropic found biased reasoning and recklessness drove Claude Mythos 5 to publish malware on PyPI and compromise a security vendor.
Node.js utilities and TypeScript definitions for package.json, tsconfig.json, and other configuration files.
# ✨ Auto-detect
npx nypm install pkg-types
# npm
npm install pkg-types
# yarn
yarn add pkg-types
# pnpm
pnpm add pkg-types
# bun
bun install pkg-types
# deno
deno install npm:pkg-types
readPackageReads any package file format (package.json, package.json5, or package.yaml) with automatic format detection.
import { readPackage } from "pkg-types";
const localPackage = await readPackage();
// or
const pkg = await readPackage("/fully/resolved/path/to/folder");
writePackageWrites package data with format detection based on file extension.
import { writePackage } from "pkg-types";
await writePackage("path/to/package.json", pkg);
await writePackage("path/to/package.json5", pkg);
await writePackage("path/to/package.yaml", pkg);
findPackageFinds the nearest package file (package.json, package.json5, or package.yaml).
import { findPackage } from "pkg-types";
const filename = await findPackage();
// or
const filename = await findPackage("/fully/resolved/path/to/folder");
readPackageJSONimport { readPackageJSON } from "pkg-types";
const localPackageJson = await readPackageJSON();
// or
const packageJson = await readPackageJSON("/fully/resolved/path/to/folder");
writePackageJSONimport { writePackageJSON } from "pkg-types";
await writePackageJSON("path/to/package.json", pkg);
resolvePackageJSONimport { resolvePackageJSON } from "pkg-types";
const filename = await resolvePackageJSON();
// or
const packageJson = await resolvePackageJSON("/fully/resolved/path/to/folder");
updatePackageReads a package file and passes a proxied PackageJson to a callback (the callback may mutate it in-place or return a new object). The updated package is then written back using the same file format (.json/.json5/.yaml). The proxy auto-creates common map fields (e.g. scripts, dependencies) when accessed.
import { updatePackage } from "pkg-types";
await updatePackage("path/to/package", (pkg) => {
pkg.version = "1.0.1";
pkg.dependencies.lodash = "^4.17.21";
});
sortPackageReturns a new PackageJson that reorders known top-level fields according to the convention and alphabetically sorts certain nested maps (like dependencies, devDependencies, optionalDependencies, peerDependencies and scripts). Unknown top-level keys retain their original relative order. The input object is not mutated.
import { sortPackage } from "pkg-types";
const sorted = sortPackage(pkg);
normalizePackageNormalizes a PackageJson for stable output: sorts top-level fields and dependency maps, and removes dependency fields (dependencies, devDependencies, optionalDependencies, peerDependencies) if they are not plain objects. Returns a new normalized object.
import { normalizePackage } from "pkg-types";
const normalized = normalizePackage(pkg);
readTSConfigimport { readTSConfig } from "pkg-types";
const tsconfig = await readTSConfig();
// or
const tsconfig2 = await readTSConfig("/fully/resolved/path/to/folder");
writeTSConfigimport { writeTSConfig } from "pkg-types";
await writeTSConfig("path/to/tsconfig.json", tsconfig);
resolveTSConfigimport { resolveTSConfig } from "pkg-types";
const filename = await resolveTSConfig();
// or
const tsconfig = await resolveTSConfig("/fully/resolved/path/to/folder");
findFileimport { findFile } from "pkg-types";
const filename = await findFile("README.md", {
startingFrom: id,
rootPattern: /^node_modules$/,
test: (filename) => filename.endsWith(".md"),
});
findNearestFileimport { findNearestFile } from "pkg-types";
const filename = await findNearestFile("package.json");
findFarthestFileimport { findFarthestFile } from "pkg-types";
const filename = await findFarthestFile("package.json");
resolveLockfileFind path to the lock file (yarn.lock, package-lock.json, pnpm-lock.yaml, npm-shrinkwrap.json, bun.lockb, bun.lock, deno.lock) or throws an error.
import { resolveLockfile } from "pkg-types";
const lockfile = await resolveLockfile(".");
findWorkspaceDirTry to detect workspace dir by in order:
pnpm-workspace.yaml, lerna.json, turbo.json, rush.json, deno.json, deno.jsonc).git/config filepackage.json fileIf fails, throws an error.
import { findWorkspaceDir } from "pkg-types";
const workspaceDir = await findWorkspaceDir(".");
resolveGitConfigFinds closest .git/config file.
import { resolveGitConfig } from "pkg-types";
const gitConfig = await resolveGitConfig(".");
readGitConfigFinds and reads closest .git/config file into a JS object.
import { readGitConfig } from "pkg-types";
const gitConfigObj = await readGitConfig(".");
writeGitConfigStringifies git config object into INI text format and writes it to a file.
import { writeGitConfig } from "pkg-types";
await writeGitConfig(".git/config", gitConfigObj);
parseGitConfigParses a git config file in INI text format into a JavaScript object.
import { parseGitConfig } from "pkg-types";
const gitConfigObj = parseGitConfig(gitConfigINI);
stringifyGitConfigStringifies a git config object into a git config file INI text format.
import { stringifyGitConfig } from "pkg-types";
const gitConfigINI = stringifyGitConfig(gitConfigObj);
typescript as a devDependency.You can directly use typed interfaces:
import type { TSConfig, PackageJson, GitConfig } from "pkg-types";
You can use define utilities for type support and auto-completion when working in plain .js files. These functions simply return the input object but provide TypeScript type hints.
definePackageJSONProvides type safety and auto-completion for package.json objects.
import { definePackageJSON } from "pkg-types";
const pkg = definePackageJSON({
name: "my-package",
version: "1.0.0",
// TypeScript will provide auto-completion here
});
defineTSConfigProvides type safety and auto-completion for tsconfig.json objects.
import { defineTSConfig } from "pkg-types";
const tsconfig = defineTSConfig({
compilerOptions: {
target: "ES2020",
// TypeScript will provide auto-completion here
},
});
defineGitConfigProvides type safety and auto-completion for git config objects.
import { defineGitConfig } from "pkg-types";
const gitConfig = defineGitConfig({
user: {
name: "John Doe",
email: "john@example.com",
},
// TypeScript will provide auto-completion here
});
Published under the MIT license.
Made by @pi0, @danielroe and community 💛
FAQs
Node.js utilities and TypeScript definitions for `package.json` and `tsconfig.json`
The npm package pkg-types receives a total of 32,125,154 weekly downloads. As such, pkg-types popularity was classified as popular.
We found that pkg-types demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Security News
Anthropic found biased reasoning and recklessness drove Claude Mythos 5 to publish malware on PyPI and compromise a security vendor.

Research
/Security News
Malicious Chrome and Firefox extensions target Axiom Trade and Padre users, stealing session tokens and wallet data.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.