
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
check-node-version
Advanced tools
Check installed versions of node, npm, npx, yarn, and pnpm.
npm install check-node-version
SYNOPSIS
check-node-version [OPTIONS]
DESCRIPTION
check-node-version will check if the current node, npm, npx, yarn and pnpm
versions match the given semver version ranges.
If the given version is not satisfied, information about
installing the needed version is printed and the program exits
with an error code.
OPTIONS
--node VERSION
Check that the current node version matches the given semver
version range.
--npm VERSION
Check that the current npm version matches the given semver
version range.
--npx VERSION
Check that the current npx version matches the given semver
version range.
--yarn VERSION
Check that the current yarn version matches the given semver
version range.
--pnpm VERSION
Check that the current pnpm version matches the given semver
version range.
--package
Use the "engines" key in the current package.json for the
semver version ranges.
--volta
Use the versions pinned by Volta in the package.json
-p, --print
Print installed versions.
-h, --help
Print this message.
Check for node 6, but have 8.2.1 installed.
$ check-node-version --node 6
node: 8.2.1
Error: Wanted node version 6 (>=6.0.0 <7.0.0)
To install node, run `nvm install 6` or see https://nodejs.org/
$ echo $?
1
If all versions match, there is no output:
$ check-node-version --node 6
$ echo $?
0
You can check versions of any combinations of node, npm, npx, yarn, and pnpm
at one time.
$ check-node-version --node 4 --npm 2.14 --npx 6 --yarn 0.17.1 --pnpm 6.20.1
You can check versions pinned by Volta:
$ check-node-version --volta
Use the --print option to print currently installed versions.
If given a tool to check, only that will be printed.
Otherwise, all known tools will be printed.
Notes a missing tool.
$ check-node-version --print --node 11.12
node: 11.12.0
$ echo $?
0
$ check-node-version --print
yarn: not found
node: 11.12.0
npm: 6.9.0
npx: 10.2.0
$ $LASTEXITCODE
0
NOTE: Both preceding examples show that this works equally cross-platform, the first one being a *nix shell, the second one running on Windows.
NOTE: As per Issue 36, non-semver-compliant versions (looking at yarn here) will be handled similarly to missing tools, just with a different error message.
At the time of writing, we think that
- all tools should always use semver
- exceptions are bound too be very rare
- preventing a crash is sufficient
Consequently, we do not intend to support non-compliant versions to any further extent.
.nvmrc file$ check-node-version --node $(cat .nvmrc) --npm 2.14
npm test{
"name": "my-package",
"devDependencies": {
"check-node-version": "^1.0.0"
},
"scripts": {
"test": "check-node-version --node '>= 4.2.3' && node my-tests.js"
}
}
This module can also be used programmatically.
Pass it an object with the required versions of node, npm, npx, yarn and/or pnpm followed by a results handler.
const check = require("check-node-version");
check(
{ node: ">= 18.3", },
(error, result) => {
if (error) {
console.error(error);
return;
}
if (result.isSatisfied) {
console.log("All is well.");
return;
}
console.error("Some package version(s) failed!");
for (const packageName of Object.keys(result.versions)) {
if (!result.versions[packageName].isSatisfied) {
console.error(`Missing ${packageName}.`);
}
}
}
);
See index.d.ts for the full input and output type definitions.
FAQs
Check installed versions of node and npm
The npm package check-node-version receives a total of 191,089 weekly downloads. As such, check-node-version popularity was classified as popular.
We found that check-node-version demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.