npmpackage.info

Gathering detailed insights and metrics for shell-quote

Other packages similar to shell-quote

@types/shell-quote

1.7.5

TypeScript definitions for shell-quote

shell-quote-word

1.0.1

unquote a single shell arguments

@adlib/shell-quote

1.0.1

Quote an args array into a quoted shell command string.

@mergesium/shell-quote

2.0.3

quote and parse shell commands

Gathering detailed insights and metrics for shell-quote

shell-quote - 1.8.3 | npmpackage.info

shell-quote

1.8.3

MIT

JavaScript

1.25 kB

4,206,737,404 4.8

Installations

npm install shell-quote

Developer Guide

BETA

Typescript

No

Module System

CommonJS

Min. Node Version

>= 0.4

Node Version

24.1.0

NPM Version

11.3.0 Pull Requests

Open

0

Total

5

Closed

1

Merged

4

Issues

Open

9

Total

16

Closed

7

Releases

Unable to fetch releases

Languages

JavaScript

JavaScript (100%)

Developer

ljharb

Download Statistics

Total Downloads

4,206,737,404

Last Day

1,409,077

Last Week

25,979,546

Last Month

112,428,031

Last Year

1,140,578,067

GitHub Statistics

MIT License

40 Stars

206 Commits

12 Forks

4 Watchers

2 Branches

18 Contributors

Updated on Jul 05, 2025

Bundle Size

2.53 kB

Minified

1.25 kB

Minified + Gzipped

Bundlephobia

Sponsor this package

https://github.com/sponsors/ljharb

Maintainers

View All 18 Contributors

Package Meta Information

Latest Version

1.8.3

Package Id

shell-quote@1.8.3

Unpacked Size

23.19 kB

Size

8.14 kB

File Count

NPM Version

11.3.0

Node Version

24.1.0

Published on

Jun 02, 2025

Total Downloads

Cumulative downloads

Total Downloads

4,206,737,404

Last Day

-4.5%

1,409,077

Compared to previous day

Last Week

-7.9%

25,979,546

Compared to previous week

Last Month

1.4%

112,428,031

Compared to previous month

Last Year

30.7%

1,140,578,067

Compared to previous year

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dev Dependencies

@ljharb/eslint-config auto-changelog encoding eslint evalmd in-publish jackspeak npmignore nyc safe-publish-latest tape

shell-quote

Parse and quote shell commands.

example

quote

1var quote = require('shell-quote/quote');
2var s = quote([ 'a', 'b c d', '$f', '"g"' ]);
3console.log(s);

output

a 'b c d' \$f '"g"'

parse

1var parse = require('shell-quote/parse');
2var xs = parse('a "b c" \\$def \'it\\\'s great\'');
3console.dir(xs);

output

[ 'a', 'b c', '\\$def', 'it\'s great' ]

parse with an environment variable

1var parse = require('shell-quote/parse');
2var xs = parse('beep --boop="$PWD"', { PWD: '/home/robot' });
3console.dir(xs);

output

[ 'beep', '--boop=/home/robot' ]

parse with custom escape character

1var parse = require('shell-quote/parse');
2var xs = parse('beep ^--boop="$PWD"', { PWD: '/home/robot' }, { escape: '^' });
3console.dir(xs);

output

[ 'beep --boop=/home/robot' ]

parsing shell operators

1var parse = require('shell-quote/parse');
2var xs = parse('beep || boop > /byte');
3console.dir(xs);

output:

[ 'beep', { op: '||' }, 'boop', { op: '>' }, '/byte' ]

parsing shell comment

1var parse = require('shell-quote/parse');
2var xs = parse('beep > boop # > kaboom');
3console.dir(xs);

output:

[ 'beep', { op: '>' }, 'boop', { comment: '> kaboom' } ]

methods

1var quote = require('shell-quote/quote');
2var parse = require('shell-quote/parse');

quote(args)

Return a quoted string for the array args suitable for using in shell commands.

parse(cmd, env={})

Return an array of arguments from the quoted string cmd.

Interpolate embedded bash-style $VARNAME and ${VARNAME} variables with the env object which like bash will replace undefined variables with "".

env is usually an object but it can also be a function to perform lookups. When env(key) returns a string, its result will be output just like env[key] would. When env(key) returns an object, it will be inserted into the result array like the operator objects.

When a bash operator is encountered, the element in the array with be an object with an "op" key set to the operator string. For example:

'beep || boop > /byte'

parses as:

[ 'beep', { op: '||' }, 'boop', { op: '>' }, '/byte' ]

install

With npm do:

npm install shell-quote

license

MIT

Critical

9.8/10

Summary

Improper Neutralization of Special Elements used in a Command in Shell-quote

Affected Versions

<= 1.7.2

Patched Versions

1.7.3

Critical

9.8/10

Summary

Potential Command Injection in shell-quote

Affected Versions

< 1.6.1

Patched Versions

1.6.1

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

Security-Policy

Determines if the project has published a security policy.

10

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

10

License

Determines if the project has defined a license.

2

Maintained

Determines if the project is "actively maintained".

1

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

Reason

dependency not pinned by hash detected -- score normalized to 0

Details

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/nodejs.yml:46: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:54: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/nodejs.yml:72: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:91: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/nodejs.yml:93: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:101: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/nodejs.yml:112: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/nodejs.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/rebase.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/rebase.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/rebase.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/rebase.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/require-allow-edits.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/require-allow-edits.yml/main?enable=pin
Info: 0 out of 5 GitHub-owned GitHubAction dependencies pinned
Info: 0 out of 7 third-party GitHubAction dependencies pinned

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Fuzzing

Determines if the project uses fuzzing.

0

SAST

Determines if the project uses static code analysis.

Score

4.8

/10

Last Scanned on 2025-06-30

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More