
Security News
TeamPCP and BreachForums Launch $1,000 Contest for Supply Chain Attacks
TeamPCP and BreachForums are promoting a Shai-Hulud supply chain attack contest with a $1,000 prize for the biggest package compromise.
Node package runner with ability to pass foreign args.
npm install --save xargv
or
yarn add xargv
or
pnpm --save xargv
Imagine a situation: you want to dynamically generate webpack config (webpack.config.js) based on provided args but webpack cli blocks you from passing any foreign values.
Below you will find way to deal with it.
In the root of the project provide .xargvrc file:
{
// command name matches first ath passed to xargv
"webpack": {
// this is the path to cli you want to execute
"binPath": "webpack/bin",
// this is the env variable name all your extra args will be placed in
"containerName": "ARGVX",
// want to pass to xargv command args without --name? Thats the map of keys
// for this values
"unnamedArgKeys": [
"unnamedA",
"unnamedB"
],
// thats the list of all args passed that should be passed as foreign vars
"foreignKeys": [
"unnamedA",
"defaultA",
"flagA",
"inlineA"
],
// This are args you dont want to define all over the package.json
// did you noticed one of this values will endup as foreign var? Neat!
"defaultArgs": {
"defaultA": "defaultValueA",
"defaultB": "defaultValueB"
}
}
}
Keep in mind you can define same config in the package.json file:
{
[...]
"xargv": {
[...]
}
}
As soon as you have config defined use it in one of the npm script's:
{
[...]
"scripts": {
"start": "xargv webpack foreignValue nativeValue --nativeFlag --nativeInline nativeInlineValue nativeUnmatchedValue"
}
}
Or via cli if you have installed package globally:
xargv webpack foreignValue nativeValue --nativeFlag --nativeInline nativeInlineValue nativeUnmatchedValue
For working examples please take a look at the repos example dir.
Full API documentation for this package can be found here
FAQs
Node package runner with ability to pass foreign args
We found that xargv demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
TeamPCP and BreachForums are promoting a Shai-Hulud supply chain attack contest with a $1,000 prize for the biggest package compromise.

Security News
Packagist urges PHP projects to update Composer after a GitHub token format change exposed some GitHub Actions tokens in CI logs.

Research
GemStuffer abuses RubyGems as an exfiltration channel, packaging scraped UK council portal data into junk gems published from new accounts.