
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
run-versions
Advanced tools
Run a script across multiple versions of an npm package
$ npm install --save run-versions
var run = require('run-versions')
run({
name: 'xtend',
command: 'npm ls xtend',
versions: ['3.0.0', '4.0.0']
}, done)
//=> done(null, [{version: '3.0.0', passed: true}, {version: '4.0.0', passed: true}])
run(options, callback) -> eventEmitterIterates through the supplied versions, running the specified shell command at each version. For details on events, see the events documentation.
Required
Type: object
Configuration objects for the runner:
Required
Type: string
The name of the package to install.
Required
Type: string
The command to run on each version.
Required
Type: array[string]
Versions to install and run against.
Type: boolean
Default: false
Set to true to treat the command as an npm script.
Type: object
Default: {}
Options to pass to spawned child processes.
Type: boolean
Default: false
Call the callback immediately with an error if any test fails.
Required
Type: function
Arguments: err, results
A callback to be called when the run completes. Installation errors are considered fatal, while test errors are only fatal when options.bail is set.
Type: array[object]
An array of objects with properties version (string) and passed (boolean) indicating test results.
A script runner is an EventEmitter and emits various events during its lifecycle. These events are:
All events receive the current version as the first argument. pre events receive the child process used to execute the installation/script/uninstallation as the second argument. The result event receives the test result (pass/fail) as the second argument. post events receive only one argument.
run(config, callback)
.on('postinstall', function (version) {
console.log('Installed', version)
})
.on('prescript', function (version, child) {
child.stdout.pipe(process.stdout)
})
Note that you can use {stdio: 'inherit'} in the child_process option if you'd prefer to pass through all output (install and uninstall logs), not just the script.
MIT © Ben Drucker
FAQs
Run a script across multiple versions of an npm package
We found that run-versions demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.