Someone more knowledgeable than me, please correct me if I'm wrong, but couldn't you create a script named

npm-audit

in your

package.json

to run your specific commands? You should be able to use the

node_run_script(entry_point="npm-audit")

BUILD file symbol in your

scripts

attribute of the

package_json

target. package.json

{
  "name": "@my/pkg",
  "scripts": {
    "npm-audit": "npm audit --audit-level=high"
  }
}

BUILD:

package_json(
    name="pkg",
    scripts=[
        node_run_script(entry_point="npm-audit"),
    ],
)

Then you should be able to run

pants run :pkg#npm-audit

.

@thankful-stone-5860 interesting idea! I don't think that would guarantee the

npm

being invoked is the

npm

that Pants/corepack installed and manages though, which is my main concern.

It appears to use the corepack version installed by pants and not the system version. I have

v24.14.1

installed (

npm

version

11.11.0

) but running the

version

script via

pants run :pkg#version

yields NodeJS version

v24.10.0

with

npm

version

11.6.2

. package.json:

{
  "name": "pkg",
  "scripts": {
    "version": "node --version && npm --version"
  }
}

BUILD:

package_json(
    name="pkg",
    scripts=[
        node_run_script(entry_point="version"),
    ],
)

pants.toml:

[GLOBAL]
pants_version = "2.31.0"
backend_packages = [
    "pants.backend.experimental.javascript"
]

[cli.alias]
all = "::"
lock = "generate-lockfiles"

[python]
interpreter_constraints = ["CPython>=3.12"]

[nodejs]
package_manager = "npm"

thanks @thankful-stone-5860!! I see, not that I need to know 😅... I'm assuming this works by Pants modifying the PATH on the fly so its package manager is seen first. this should work for our needs though, thank you for confirming

thanks Casey!