npmpackage.info

Gathering detailed insights and metrics for shell-quote

Other packages similar to shell-quote

@types/shell-quote

1.7.5

TypeScript definitions for shell-quote

shell-quote-word

1.0.1

unquote a single shell arguments

@adlib/shell-quote

1.0.1

Quote an args array into a quoted shell command string.

@mergesium/shell-quote

2.0.3

quote and parse shell commands

Gathering detailed insights and metrics for shell-quote

shell-quote - 1.8.3 | npmpackage.info

shell-quote

1.8.3

MIT

JavaScript

23.19 kB

4.8

Installations

npm install shell-quote

Developer Guide

BETA

Typescript

No

Module System

CommonJS

Min. Node Version

>= 0.4

Node Version

24.1.0

NPM Version

11.3.0 Pull Requests

Open

0

Total

5

Closed

1

Merged

4

Issues

Open

9

Total

16

Closed

7

Releases

Unable to fetch releases

Languages

JavaScript

JavaScript (100%)

Developer

ljharb

Download Statistics

Total Downloads

Last Day

Last Week

Last Month

Last Year

GitHub Statistics

MIT License

40 Stars

206 Commits

12 Forks

4 Watchers

2 Branches

18 Contributors

Updated on Jul 05, 2025

Sponsor this package

https://github.com/sponsors/ljharb

Maintainers

View All 18 Contributors

Package Meta Information

Latest Version

1.8.3

Package Id

shell-quote@1.8.3

Unpacked Size

23.19 kB

Size

8.14 kB

File Count

NPM Version

11.3.0

Node Version

24.1.0

Published on

Jun 02, 2025

Total Downloads

Cumulative downloads

Total Downloads

NaN

Last Day

NaN

Compared to previous day

Last Week

NaN

Compared to previous week

Last Month

NaN

Compared to previous month

Last Year

NaN

Compared to previous year

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dev Dependencies

@ljharb/eslint-config auto-changelog encoding eslint evalmd in-publish jackspeak npmignore nyc safe-publish-latest tape

shell-quote

Parse and quote shell commands.

example

quote

1var quote = require('shell-quote/quote');
2var s = quote([ 'a', 'b c d', '$f', '"g"' ]);
3console.log(s);

output

a 'b c d' \$f '"g"'

parse

1var parse = require('shell-quote/parse');
2var xs = parse('a "b c" \\$def \'it\\\'s great\'');
3console.dir(xs);

output

[ 'a', 'b c', '\\$def', 'it\'s great' ]

parse with an environment variable

1var parse = require('shell-quote/parse');
2var xs = parse('beep --boop="$PWD"', { PWD: '/home/robot' });
3console.dir(xs);

output

[ 'beep', '--boop=/home/robot' ]

parse with custom escape character

1var parse = require('shell-quote/parse');
2var xs = parse('beep ^--boop="$PWD"', { PWD: '/home/robot' }, { escape: '^' });
3console.dir(xs);

output

[ 'beep --boop=/home/robot' ]

parsing shell operators

1var parse = require('shell-quote/parse');
2var xs = parse('beep || boop > /byte');
3console.dir(xs);

output:

[ 'beep', { op: '||' }, 'boop', { op: '>' }, '/byte' ]

parsing shell comment

1var parse = require('shell-quote/parse');
2var xs = parse('beep > boop # > kaboom');
3console.dir(xs);

output:

[ 'beep', { op: '>' }, 'boop', { comment: '> kaboom' } ]

methods

1var quote = require('shell-quote/quote');
2var parse = require('shell-quote/parse');

quote(args)

Return a quoted string for the array args suitable for using in shell commands.

parse(cmd, env={})

Return an array of arguments from the quoted string cmd.

Interpolate embedded bash-style $VARNAME and ${VARNAME} variables with the env object which like bash will replace undefined variables with "".

env is usually an object but it can also be a function to perform lookups. When env(key) returns a string, its result will be output just like env[key] would. When env(key) returns an object, it will be inserted into the result array like the operator objects.

When a bash operator is encountered, the element in the array with be an object with an "op" key set to the operator string. For example:

'beep || boop > /byte'

parses as:

[ 'beep', { op: '||' }, 'boop', { op: '>' }, '/byte' ]

install

With npm do:

npm install shell-quote

license

MIT

Critical

9.8/10

Summary

Improper Neutralization of Special Elements used in a Command in Shell-quote

Affected Versions

<= 1.7.2

Patched Versions

1.7.3

Critical

9.8/10

Summary

Potential Command Injection in shell-quote

Affected Versions

< 1.6.1

Patched Versions

1.6.1

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

Security-Policy

Determines if the project has published a security policy.

10

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

10

License

Determines if the project has defined a license.

2

Maintained

Determines if the project is "actively maintained".

1

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

Reason

dependency not pinned by hash detected -- score normalized to 0

Details

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/nodejs.yml:46: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:54: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/nodejs.yml:72: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:91: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/nodejs.yml:93: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:101: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/nodejs.yml:112: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/nodejs.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/rebase.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/rebase.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/rebase.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/rebase.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/require-allow-edits.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/require-allow-edits.yml/main?enable=pin
Info: 0 out of 5 GitHub-owned GitHubAction dependencies pinned
Info: 0 out of 7 third-party GitHubAction dependencies pinned

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Fuzzing

Determines if the project uses fuzzing.

0

SAST

Determines if the project uses static code analysis.

Score

4.8

/10

Last Scanned on 2025-06-30

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More