which-pm-runs
Advanced tools
Detects what package manager executes the process
Supports npm, pnpm, Yarn, cnpm, and bun. And also any other package manager that sets the npm_config_user_agent env variable.
pnpm add which-pm-runs
'use strict'
const whichPMRuns = require('which-pm-runs')
whichPMRuns()
//> {name: "pnpm", version: "0.64.2"}
MIT © Zoltan Kochan
Similar to `which-pm-runs`, `detect-package-manager` is designed to identify the package manager used in the current environment. It can detect npm, yarn, and pnpm. The main difference lies in the approach and additional features it might offer, such as more detailed detection mechanisms or broader support for package managers.
While `npm-which` is focused more on locating the binaries of npm packages installed in the local node_modules folder, it shares the concept of detecting npm-related tools with `which-pm-runs`. However, `npm-which` is more about finding the path to an executable rather than identifying the package manager itself.
FAQs
Detects what package manager executes the process
The npm package which-pm-runs receives a total of 3,192,434 weekly downloads. As such, which-pm-runs popularity was classified as popular.
We found that which-pm-runs demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.
Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.