
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
pnpm-version-util
Advanced tools
Simple CLI utility to read package version from package.json - a pnpm-friendly alternative to 'npm version'
A simple CLI utility to read package version from package.json - a pnpm-friendly alternative to npm version.
Running pnpm version doesn't work because pnpm doesn't have a native version command. When it falls back to npm, it often fails due to package manager constraints or workspace configurations.
This package provides a simple CLI that reads the version from package.json in the current directory. No configuration needed, just works!
npm install -g pnpm-version-util
# or
pnpm add -g pnpm-version-util
pnpm add -D pnpm-version-util
After global installation:
pnpm-version
# Output: 1.0.0
pnpm exec pnpm-version
# Output: 1.0.0
{
"scripts": {
"version": "pnpm-version"
}
}
Then run:
pnpm run version
# Output: 1.0.0
For even shorter commands, add to your ~/.zshrc or ~/.bashrc:
alias pv='pnpm-version'
Then simply run:
pv
# Output: 1.0.0
Always outputs just the version number with no extra noise:
1.0.0
Clean output makes it perfect for:
# Create git tag from package version
git tag "v$(pnpm-version)"
# Use in release script
VERSION=$(pnpm-version)
echo "Releasing version $VERSION"
You can also use this package programmatically in your Node.js code:
import { getVersion } from 'pnpm-version-util';
// Get version from current directory
const version = getVersion();
console.log(version); // "1.0.0"
// Get version from specific directory
const version = getVersion({ cwd: '/path/to/package' });
console.log(version); // "2.3.4"
interface GetVersionOptions {
/** Path to the directory containing package.json. Defaults to current working directory. */
cwd?: string;
}
function getVersion(options?: GetVersionOptions): string
✅ Zero Configuration - Works out of the box
✅ Clean Output - Just the version number, nothing else
✅ Fast - Synchronous file read, instant results
✅ Reliable - Comprehensive test coverage
✅ Flexible - CLI + programmatic API
✅ TypeScript - Full type definitions included
# Install dependencies
pnpm install
# Run tests
pnpm test
# Build
pnpm run build
# Run locally
./build/cli.js
Contributions are welcome! Please feel free to submit a Pull Request.
git checkout -b feature/amazing-feature)git commit -m 'Add some amazing feature')git push origin feature/amazing-feature)MIT © Amitai Salmon
Found a bug or have a suggestion? Please open an issue.
Give a ⭐️ if this project helped you!
FAQs
Simple CLI utility to read package version from package.json - a pnpm-friendly alternative to 'npm version'
We found that pnpm-version-util demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.