
Security News
Package Maintainers Call for Improvements to GitHub’s New npm Security Plan
Maintainers back GitHub’s npm security overhaul but raise concerns about CI/CD workflows, enterprise support, and token management.
CLI tool to run npm scripts with either npm, pnpm or yarn, depending on how it was started
A CLI tool to run npm scripts with either npm
, pnpm
or yarn
, depending on how it was started. Useful for setups
where some team members use npm
while others use pnpm
or yarn
, especially when Windows and Unix-like systems are
used across the team.
This tool is a helper to run scripts from package.json
. Just substitute all npm
, pnpm
or yarn
calls with yarpm
and you're good to go:
{
"scripts": {
"start": "yarpm run build",
"build": "tsc index.ts"
}
}
When running the start
script with yarn start
, the dependent build
script will be spawned with yarn
:
~/test$ yarn start
yarn start v1.22.5
$ yarpm run build
$ tsc index.ts
✨ Done in 2.27s.
Running the same script with npm start
will result in the dependent build
being run with npm
:
~/test$ npm start
> test@0.0.1 start /home/me/test
> yarpm run build
> test@0.0.1 build /home/me/test
> tsc index.ts
This tool is not meant to be an abstraction layer for calling npm
, pnpm
or yarn
. It will pass all arguments
it receives unfiltered to the chosen package manager. You'll have to make sure that the package manager commands you use
are compatible with all the package managers you want your commands to work with.
$ npm install yarpm --save-dev
# or
$ pnpm add yarpm --save-dev
# or
$ yarn add yarpm --dev
The yarpm
package provides 3 CLI commands:
The main command is yarpm
.
This command is an in-place substitute for places in package.json
where npm
, pnpm
or yarn
is being used
explicitly. It reads the npm_execpath
environment variable to determine the path to the currently used package
manager. This env var is only set when running yarpm
as a script. If yarpm
is used without being embedded
in a script, it will always choose npm
.
This command can be used in places where you are not in control of how your script is being started, for example when
using husky
to run a script as a git hook. This script will always prefer pnpm
over npm
unless pnpm
is not
available. Only then will it fall back to npm
.
This command can be used in places where you are not in control of how your script is being started, for example when
using husky
to run a script as a git hook. This script will always prefer yarn
over npm
unless yarn
is not
available. Only then will it fall back to npm
.
The yarpm
package provides a node API.
const yarpm = require('yarpm');
const promise = yarpm(argv, options);
string[]
-- The argument list to pass to npm/pnpm/yarn.object|undefined
string
-
The path to npm/pnpm/yarn.
Default is process.env.npm_execpath
if set, npm
otherwise.object
-
Sets the environment key-value pairs, replaces the default usage of process.env to spawn child process.stream.Readable|null
--
A readable stream to send messages to stdin of child process.
If this is null
or undefined
, ignores it.
If this is process.stdin
, inherits it.
Otherwise, makes a pipe.
Default is null
.
Set to process.stdin
in order to send from stdin.stream.Writable|null
--
A writable stream to receive messages from stdout of child process.
If this is null
or undefined
, cannot send.
If this is process.stdout
, inherits it.
Otherwise, makes a pipe.
Default is null
.
Set to process.stdout
in order to print to stdout.stream.Writable|null
--
A writable stream to receive messages from stderr of child process.
If this is null
or undefined
, cannot send.
If this is process.stderr
, inherits it.
Otherwise, makes a pipe.
Default is null
.
Set to process.stderr
in order to print to stderr.yarpm
returns a promise will be resolved when the spawned process exits, regardless of the exit code.
The promise will be rejected in case of an internal error inside of yarpm
.
The promise is resolved with an object with the following 2 properties: spawnArgs
and code
.
The spawnArgs
property contains the array of parameters that were passed to spawn the sub-process.
The code
property is the exit code of the sub-process.
yarpm(['install']).then((result) => {
console.log(`${result.spawnArgs} -- ${result.code}`);
// if executed as a package.json script via yarn: /usr/share/yarn/bin/yarn.js,install -- 0
});
https://github.com/BendingBender/yarpm/blob/master/CHANGELOG.md
Clone the repo and make a pull request. Thank you for contributing!
Please use GitHub Issues.
v1.2.0
FAQs
CLI tool to run npm scripts with either npm, pnpm or yarn, depending on how it was started
The npm package yarpm receives a total of 3,195 weekly downloads. As such, yarpm popularity was classified as popular.
We found that yarpm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Maintainers back GitHub’s npm security overhaul but raise concerns about CI/CD workflows, enterprise support, and token management.
Product
Socket Firewall is a free tool that blocks malicious packages at install time, giving developers proactive protection against rising supply chain attacks.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.