
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
RS is a CLI tool for quickly detecting package.json scripts, and running them.
RS was created to address my frustration with working in multiple projects that use different package managers and have various scripts defined, and to provide a simple and intuitive way to list and execute npm scripts without having to remember the exact syntax or navigate through a project's configuration.
Package Manager Agnostic: RS automatically detects whether your project uses npm, yarn, pnpm, or bun, eliminating the need to remember or switch between different commands.
Quick Script Discovery: Use rs or rs -l to instantly view all scripts, eliminating the need to search through package.json.
Simplified Execution: Run any script with a simple rs <script-name> command, without needing to prefix it with npm run, yarn, or other package manager-specific commands.
Global Scripts: RS allows you to define and run global scripts that are not defined in your project's package.json, making it easy to reuse common scripts across multiple projects.
Directory Scripts: RS supports directory-specific scripts that are tied to the current working directory, perfect for projects without a package.json or for custom build scripts you don't want to clutter your global scripts with.
package.json--verbose)You can use RS in two ways: by installing it globally or by using it with npx.
To install RS globally, use the following command:
npm install -g rs-runner
You can also use RS without installing it globally by using npx:
npx rs-runner <script>
Replace <script> with the name of the script you want to run.
To list all available scripts in your project, use the following command:
rs
or
rs -l
This will display a list of all scripts defined in your package.json file, directory scripts for the current path, and global scripts.
To run a specific script, use the following command:
rs <script>
Replace <script> with the name of the script you want to run. RS will check for scripts in this order:
For an interactive script selection experience, use:
rs -i
This will present you with a list of all available scripts organized by type (package, directory, global) that you can select from.
RS supports running global scripts that are not defined in your local package.json.
This is particularly useful for running scripts that you use across multiple projects.
To add a global script, use the following command:
rs -a <key> <value>
For example:
rs -a hello "echo hello world"
This will add a global script named "hello" that echoes "hello world" when run.
To delete a global script, use the following command:
rs -d <key>
For example:
rs -d hello
Use verbose mode to troubleshoot script detection and execution:
rs --verbose test
This displays:
Directory scripts are perfect for situations where you want to run something specific to the current directory but don't have a package.json or don't want to clutter your global scripts.
To add a directory script, use the following command:
rs --add-dir <key> <value>
For example:
rs --add-dir build "gcc -o main main.c"
This will add a directory script named "build" that compiles a C program, but only for the current directory.
To delete a directory script, use the following command:
rs --delete-dir <key>
For example:
rs --delete-dir build
You can run any package manager command with rs by using the following command (as long as it's not a script defined in the package.json, directory scripts, or globally):
rs <command>
For example:
rs install
rs
rs add lodash
rs dev
If you need to run a package manager command that includes options (e.g., commands with dashes), encapsulate the entire command in quotes:
rs "install --save-dev typescript"
RS stores scripts in a config file at ~/.rsrc. You can export and import this config for backup or syncing across machines.
rs --export backup.json
Merge with existing config:
rs --import backup.json
Replace entire config:
rs --import backup.json --replace
When importing, RS will prompt for confirmation if scripts would be overwritten.
RS stores global and directory scripts in ~/.rsrc (or .rsrc in your home directory). The config is a JSON file with the following structure:
{
"scripts": {
"hello": "echo hello world"
},
"directories": {
"/path/to/project": {
"build": "make all"
}
}
}
scripts: Global scripts available everywheredirectories: Scripts specific to each directory pathRS checks for scripts in the following order:
package.jsonIf RS can't find your script, use verbose mode to debug:
rs --verbose <script-name>
This shows where RS is looking and which scripts are available.
RS detects package managers by looking for lock files in this order:
bun.lockb → bunpnpm-lock.yaml → pnpmyarn.lock → yarnpackage-lock.json → npmdeno.json / deno.jsonc → denoMake sure the appropriate lock file exists in your project root.
Check your config location and contents:
rs --verbose -l
Config is stored at ~/.rsrc. If it's corrupted, you can export/backup, delete it, and reimport.
When running commands with flags or special characters, quote the entire command:
rs "install --save-dev typescript"
This project is licensed under the MIT License. See the LICENSE file for more details.
If you find any issues or have suggestions for improvements, please open an issue or submit a pull request.
If you need help or have questions, please open an issue on the GitHub repository.
FAQs
RS is a CLI tool for quickly detecting package.json scripts, and running them.
We found that rs-runner demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.