
Security News
Agent Baseline Publishes Security Reference Architecture for Software Factories
Agent Baseline’s new reference architecture shows how to secure software factories with four boundaries enforced outside the AI agent.
which-command
Advanced tools
Find the absolute path to a command's executable, like the Unix `which` command
Find the absolute path to a command's executable, like the Unix
whichcommand
Useful for locating an executable in PATH before spawning it, checking whether a tool is installed, or building your own CLI tooling.
Works cross-platform, including Windows PATHEXT handling and App Execution Aliases.
npm install which-command
import {whichCommand, whichCommandSync, whichCommandAll} from 'which-command';
await whichCommand('node');
//=> '/usr/local/bin/node'
await whichCommand('does-not-exist');
//=> undefined
whichCommandSync('node');
//=> '/usr/local/bin/node'
await whichCommandAll('node');
//=> ['/usr/local/bin/node', '/opt/homebrew/bin/node']
Returns a Promise for the absolute path to the first matching executable, or undefined if not found.
Same as whichCommand(), but synchronous.
Returns a Promise for an array of the absolute paths to all matching executables in PATH order, or an empty array if none are found. Like which -a.
Same as whichCommandAll(), but synchronous.
Type: string
The command name to look for, or a path to check directly.
If it contains a directory separator (like ./foo or /usr/bin/foo), it's resolved directly instead of being searched for in PATH.
Type: object
Type: string
Default: process.cwd()
The directory to resolve relative paths against.
Relative path entries and commands that contain a directory separator are resolved against this. On Windows, this directory is also searched before PATH.
Type: string
Default: process.env.PATH
The PATH to search.
Empty entries are ignored. Unlike a POSIX shell, an empty entry is not treated as the current directory, since implicitly searching the current directory is a security risk.
Type: string
Default: process.env.PATHEXT
The executable file extensions to look for, as a ;-separated string.
Only used on Windows. Corresponds to the PATHEXT environment variable.
$ npx which-command --help
Usage
$ which-command <command> …
Options
--all, -a List all matching paths, not just the first
--silent, -s Suppress output; the exit code still reflects whether all commands were found
Examples
$ which-command node
/usr/local/bin/node
$ which-command --all node
/usr/local/bin/node
/opt/homebrew/bin/node
Exits with code 1 if any of the commands could not be found.
which package?undefined when a command is not found, instead of throwing.whichCommandAll() deduplicates results, so duplicate PATH entries don't produce duplicate matches.PATH entries are ignored instead of implicitly searching the current directory.python and winget stubs in WindowsApps), which which skips.FAQs
Find the absolute path to a command's executable, like the Unix `which` command
The npm package which-command receives a total of 2,086,914 weekly downloads. As such, which-command popularity was classified as popular.
We found that which-command demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Agent Baseline’s new reference architecture shows how to secure software factories with four boundaries enforced outside the AI agent.

Security News
arXiv now limits authors to two submissions a month as AI slop overwhelms moderators, delays good papers, and sparks debate over applying the limit to everyone.

Research
/Security News
A new GhostAction wave hits hundreds of GitHub repos, expanding CI/CD secret theft to cloud and AI credentials in source code and git history.