Returns path to globally installed package
Installations
npm install global-modules-path
Developer Guide
Typescript
No
Module System
CommonJS
Node Version
14.18.1
NPM Version
6.14.15
Releases
Contributors
Unable to fetch Contributors
Languages
JavaScript (98.64%)
Shell (0.69%)
Batchfile (0.66%)
Developer
rosen-vladimirov
Download Statistics
Total Downloads
90,664,990
Last Day
13,020
Last Week
44,249
Last Month
201,735
Last Year
3,254,041
GitHub Statistics
1 Stars
40 Commits
2 Forks
3 Watching
3 Branches
4 Contributors
Bundle Size
2.36 kB
Minified
0.99 kB
Minified + Gzipped
Package Meta Information
Latest Version
3.0.0
Package Id
global-modules-path@3.0.0
Unpacked Size
20.86 kB
Size
6.95 kB
File Count
5
NPM Version
6.14.15
Node Version
14.18.1
Publised On
08 Jan 2023
Total Downloads
Cumulative downloads
Total Downloads
90,664,990
Last day
51%
13,020
Compared to previous day
Last week
-0.4%
44,249
Compared to previous week
Last month
14.1%
201,735
Compared to previous month
Last year
-43.3%
3,254,041
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dev Dependencies
5
global-modules-path
Returns path to globally installed package.
System requirements
In order to use this package you need:
- Node.js 4.0.0 or later
- npm 2.0.0 or later added to your PATH environment variable (you should be able to execute
npm --version
from your default terminal).
Usage
The module has a single public method called getPath
. It requires at least one argument - the name of the globally installed package that you need.
In case the package is not installed, getPath
will return null.
getPath
will throw error in case the OS is NOT supported. Supported OS are:
- Windows (
process.platform
returnswin32
) - macOS (
process.platform
returnsdarwin
) - Linux (
process.platform
returnslinux
)
Using getPath with single argument
Example:
let pathToPackage = require("global-modules-path").getPath("packageName");
The method returns the path to globally installed package or null. The code constructs the path based on the result of npm config get prefix
and checks if the package exists.
Using getPath with package name and executable name.
Example:
let pathToPackage = require("global-modules-path").getPath("packageName", "executableName");
The method returns the path to globally installed package or null. The code constructs the path based on the result of npm config get prefix
and checks if the package exists. In case the package cannot be found in this way, the executableName
is used to determine if the package is globally installed.
- On Windows the package spawns
where executableName
command and parses the result. - On macOS and Linux the package spawns
ls -l executableName
andwhich executableName
and parses the results.
NOTE: In some cases the executable name is not the same as the package name.
Stable Version
Stable Version
3.0.0
CRITICAL
1
9.8/10
Summary
global-modules-path Command Injection vulnerability
Affected Versions
< 3.0.0
Patched Versions
3.0.0
Reason
no dangerous workflow patterns detected
Reason
no binaries found in the repo
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0
Reason
SAST tool detected but not run on all commits
Details
- Info: SAST configuration detected: CodeQL
- Warn: 0 commits out of 25 are checked with a SAST tool
Reason
4 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
- Warn: Project is vulnerable to: GHSA-mwcw-c2x4-8c55
- Warn: Project is vulnerable to: GHSA-j8xg-fqg3-53r7
Reason
Found 3/13 approved changesets -- score normalized to 2
Reason
dependency not pinned by hash detected -- score normalized to 1
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:43: update your workflow using https://app.stepsecurity.io/secureworkflow/rosen-vladimirov/global-modules-path/codeql.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:47: update your workflow using https://app.stepsecurity.io/secureworkflow/rosen-vladimirov/global-modules-path/codeql.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:61: update your workflow using https://app.stepsecurity.io/secureworkflow/rosen-vladimirov/global-modules-path/codeql.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:74: update your workflow using https://app.stepsecurity.io/secureworkflow/rosen-vladimirov/global-modules-path/codeql.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node.js.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/rosen-vladimirov/global-modules-path/node.js.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node.js.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/rosen-vladimirov/global-modules-path/node.js.yml/master?enable=pin
- Warn: npmCommand not pinned by hash: integration-tests/linux.sh:3
- Warn: npmCommand not pinned by hash: integration-tests/linux.sh:4
- Info: 0 out of 6 GitHub-owned GitHubAction dependencies pinned
- Info: 1 out of 3 npmCommand dependencies pinned
Reason
0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Reason
security policy file not detected
Details
- Warn: no security policy file detected
- Warn: no security file to analyze
- Warn: no security file to analyze
- Warn: no security file to analyze
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql.yml:28
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:29
- Warn: no topLevel permission defined: .github/workflows/codeql.yml:1
- Warn: no topLevel permission defined: .github/workflows/node.js.yml:1
- Info: no jobLevel write permissions found
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
Project has not signed or included provenance with any releases.
Details
- Warn: release artifact v3.0.0 not signed: https://api.github.com/repos/rosen-vladimirov/global-modules-path/releases/88248865
- Warn: release artifact v2.3.1 not signed: https://api.github.com/repos/rosen-vladimirov/global-modules-path/releases/14282733
- Warn: release artifact v2.1.0 not signed: https://api.github.com/repos/rosen-vladimirov/global-modules-path/releases/10219219
- Warn: release artifact v3.0.0 does not have provenance: https://api.github.com/repos/rosen-vladimirov/global-modules-path/releases/88248865
- Warn: release artifact v2.3.1 does not have provenance: https://api.github.com/repos/rosen-vladimirov/global-modules-path/releases/14282733
- Warn: release artifact v2.1.0 does not have provenance: https://api.github.com/repos/rosen-vladimirov/global-modules-path/releases/10219219
Score
3.8
/10
Last Scanned on 2025-01-27
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn MoreOther packages similar to global-modules-path
global-modules
The directory used by npm for globally installed npm modules.
global-prefix
Get the npm global path prefix.
global-dirs
Get the directory of globally installed packages and binaries
resolve-dir
Resolve a directory that is either local, global or in the user's home directory.