
Security News
Feross on TBPN: How North Korea Hijacked Axios
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.
A minimal CLI that forwards commands to whichever package manager you're already using.
What's happening here: A project replaces hardcoded npm and npx calls with pkgmgr and pkgmgrx in their package.json scripts. Now when a contributor runs pnpm run dev, the script uses pnpm. When another runs bun run dev, it uses bun. No configuration, no conditional logic—just automatic package manager detection.
You're writing a script, a tool, or documentation that needs to run package manager commands. But different users use different package managers (npm, pnpm, yarn, bun), and you don't want to:
pkgmgr detects which package manager invoked the current process and forwards your command to it verbatim. It's a best-effort user-intent propagation tool.
pkgmgr install # runs: <detected-pm> install
pkgmgr add react # runs: <detected-pm> add react
pkgmgr remove lodash # runs: <detected-pm> remove lodash
pkgmgr run build # runs: <detected-pm> run build
pkgmgr exec vitest # runs: <detected-pm> exec vitest
pkgmgr)Forward commands directly to the detected package manager.
| Binary | Fallback |
|---|---|
pkgmgr | npm |
pkgmgr-bun | bun |
pkgmgr-pnpm | pnpm |
pkgmgr-yarn | yarn |
pkgmgrx)Forward commands to the detected package manager's "exec" equivalent.
| Binary | Fallback | Executes |
|---|---|---|
pkgmgrx | npm | npx <args> |
pkgmgrx-bun | bun | bunx <args> |
pkgmgrx-pnpm | pnpm | pnpm dlx <args> |
pkgmgrx-yarn | yarn | yarn dlx <args> |
pkgmgrx cowsay "Hello" # runs: npx cowsay "Hello" (or bunx, pnpm dlx, yarn dlx)
pkgmgrx tsc --version # runs: npx tsc --version
All binaries use the same detection logic. The only difference is which package manager is used when detection fails (no PKGMGR env var and no npm_config_user_agent).
pkgmgr determines which package manager to use in this order:
PKGMGR environment variable — If set to a supported value, use itnpm_config_user_agent — Parse the first token (e.g., pnpm/8.0.0 → pnpm)npmThis is heuristic detection, not verification. pkgmgr trusts the environment.
Set the PKGMGR environment variable to force a specific package manager:
PKGMGR=pnpm pkgmgr add zod
# Install dependencies (default command if no args)
pkgmgr
# Add a package
pkgmgr add express
# Remove a package
pkgmgr remove lodash
# Run a script
pkgmgr run test
# Run with arguments
pkgmgr run build -- --watch
# Execute a binary
pkgmgr exec tsc --version
# Override detection
PKGMGR=yarn pkgmgr add react
Good fit:
Not a good fit:
pkgmgr add is passed verbatim; if you're using npm, you may need pkgmgr install instead. This tool does not normalize commands between package managers.npm_config_user_agent, which may not be set in all CI contexts. Use PKGMGR explicitly if needed.Running npx pkgmgr add react defeats the purpose. npx is part of npm, so it sets npm_config_user_agent to npm. pkgmgr would detect npm and run npm add react—regardless of what package manager you actually use.
The same applies to other package runners:
npx pkgmgr ... → detects npmpnpm dlx pkgmgr ... → detects pnpmyarn dlx pkgmgr ... → detects yarnbunx pkgmgr ... → detects bunpkgmgr is meant to be installed as a dependency in your project. When users run your scripts through their package manager (e.g., pnpm run setup), pkgmgr detects the invoking package manager from within that context.
npm install pkgmgr
# or
pnpm add pkgmgr
# or
yarn add pkgmgr
# or
bun add pkgmgr
MIT
FAQs
Forward commands to the package manager you're already using
We found that pkgmgr demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.

Security News
OpenSSF has issued a high-severity advisory warning open source developers of an active Slack-based campaign using impersonation to deliver malware.

Research
/Security News
Malicious packages published to npm, PyPI, Go Modules, crates.io, and Packagist impersonate developer tooling to fetch staged malware, steal credentials and wallets, and enable remote access.