
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
global-modules
Advanced tools
The directory used by npm for globally installed npm modules.
Please consider following this project's author, Jon Schlinkert, and consider starring the project to show your :heart: and support.
Install with npm:
$ npm install --save global-modules
const globalModules = require('global-modules');
console.log(globalModules);
//=> '/usr/local/lib/node_modules'
(Note that this path might be different based on platform, user-defined configuration settings, etc)
Pull requests and stars are always welcome. For bugs and feature requests, please create an issue.
Running and reviewing unit tests is a great way to get familiarized with a library and its API. You can install dependencies and run tests with the following command:
$ npm install && npm test
(This project's readme.md is generated by verb, please don't edit the readme directly. Any changes to the readme must be made in the .verb.md readme template.)
To generate the readme, run the following command:
$ npm install -g verbose/verb#dev verb-generate-readme && verb
You might also be interested in these projects:
| Commits | Contributor |
|---|---|
| 20 | jonschlinkert |
| 1 | Kikobeats |
Jon Schlinkert
Copyright © 2018, Jon Schlinkert. Released under the MIT License.
This file was generated by verb-generate-readme, v0.8.0, on December 14, 2018.
The global-prefix package is similar to global-modules in that it provides the location of the global npm prefix, which is the directory where global packages are installed. However, global-prefix focuses on the prefix path itself rather than the node_modules directory.
The global-npm package can locate the npm binary that is installed globally on the system. While it serves a different purpose than global-modules, it is related in the sense that it deals with global npm installations.
The which-pm-runs package is used to detect which package manager is currently running the script. It is not directly related to finding the location of global modules, but it is useful in a global npm context to understand which package manager is in use.
FAQs
The directory used by npm for globally installed npm modules.
The npm package global-modules receives a total of 21,715,145 weekly downloads. As such, global-modules popularity was classified as popular.
We found that global-modules demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.