which
npmv7.0.0Like which(1) unix command. Find the first instance of an executable in the PATH.
Safe to adopt
Yes — which scores well across adoption, maintenance, weight, supply chain, and licensing. 290.2M downloads per week and 9 known dependents. Last published 124 days ago. 4 releases in the last 2 years.
- AAdoption: grade A, Excellent.
290.2M downloads per week and 9 known dependents.
- BMaintenance: grade B, Good.
Last published 124 days ago. 4 releases in the last 2 years.
- AWeight: grade A, Excellent.
Pulls in 1 transitive package, about 70 KB installed.
- ASupply chain: grade A, Excellent.
No install scripts, 4 maintainers, and a contained dependency surface.
- ALicense: grade A, Excellent.
ISC — permissive, with no copyleft found in the dependency tree.
Grades are computed deterministically from registry metadata collected by PackageGraph — downloads, dependents, publish dates, the resolved dependency tree, maintainer count, and declared licenses. No third-party scores are used.
Install cost
What you actually take on by adding which to a project.
Runtime packages this one declares itself.
Distinct packages in the full runtime tree, deduplicated the way a package manager would.
Unpacked size of this package plus its entire runtime tree.
Longest resolved dependency chain below this package.
Licenses in the dependency tree
Every license you inherit by installing which, not just its own. Check this before a legal review, not after.
Compatibility
- Node.js
- node ^22.22.2 || ^24.15.0 || >=26.0.0
- Module format
- CommonJS only
- TypeScript
- No bundled types
- Install scripts
- None
Quick start
A usage example from the which README.
const which = require('which')
// async usage
// rejects if not found
const resolved = await which('node')
// if nothrow option is used, returns null if not found
const resolvedOrNull = await which('node', { nothrow: true })
// sync usage
// throws if not found
const resolved = which.sync('node')
// if nothrow option is used, returns null if not foundDependencies
Declared by which v7.0.0. Runtime dependencies are installed with the package; dev dependencies are not.
Runtime (1)
Dev (3)
Used by
Popular packages that depend on which.
Module for reading .pgpass
A Node.js module for sending notifications on native Mac, Windows (post and pre 8) and Linux (or Growl as fallback)
A replacement for process.exit that ensures stdio are fully drained before exiting.
yargs the modern, pirate-themed, successor to optimist.
Microsofts' EdgeDriver for Node.js
Get the paths of edge browser easily
Cross platform child_process#spawn and child_process#spawnSync
Info about your dev environment for debugging purposes
The official Node.js client library for Gel
Relationship graph
Dependencies (left) and dependents (right) of which.
Frequently installed together
An AST-based pattern checker for JavaScript.
TypeScript definitions for node
Delightful JavaScript Testing.
easily create complex multi-column command-line-interfaces
the mighty option parser used by yargs
A tiny (183B to 210B) and fast utility to ascend parent directories
the bare-bones internationalization library used by yargs
Prettier is an opinionated code formatter
BDD/TDD assertion library for node.js and the browser. Test framework agnostic.
Cross platform child_process#spawn and child_process#spawnSync
TypeScript definitions for chai
The semantic version parser used by npm.
Release history
3 releases in the last two years, typically about 92 days apart.
| Version | Published | Size | License |
|---|---|---|---|
| 7.0.0latest | 4 months ago | 7.3 KB | ISC |
| 6.0.1 | 7 months ago | 7.3 KB | ISC |
| 6.0.0 | 10 months ago | 7.3 KB | ISC |
| 5.0.0 | 1 year ago | 7.3 KB | ISC |
| 4.0.0 | 3 years ago | 7.3 KB | ISC |
| 3.0.1 | 3 years ago | 7.3 KB | ISC |
| 3.0.0 | 3 years ago | 7.0 KB | ISC |
| 2.0.2 | 6 years ago | 9.7 KB | ISC |
| 2.0.1 | 7 years ago | 9.7 KB | ISC |
| 2.0.0 | 7 years ago | 9.2 KB | ISC |
| 1.3.1 | 8 years ago | 9.2 KB | ISC |
| 1.3.0 | 9 years ago | — | ISC |
| 1.2.14 | 9 years ago | — | ISC |
| 1.2.13 | 9 years ago | — | ISC |
| 1.2.12 | 9 years ago | — | ISC |
Overview
which is an npm package that like which(1) unix command. Find the first instance of an executable in the PATH. It is extremely widely used, with about 290.2M downloads per week and 9 known dependents in the graph. The latest version is 7.0.0, released under the ISC license.
Who should use it
Teams working in the npm ecosystem who need like which(1) unix command. Find the first instance of an executable in the PATH and value a battle-tested, widely-adopted solution.
When not to use it
Consider an alternative if you need to have first-class TypeScript types out of the box, or if a more actively-maintained option better fits your npm stack.
Pros
- Large, well-established user base (290.2M weekly downloads).
- Clear open-source license (ISC).
Cons
- No bundled TypeScript types (may require a separate @types package).
Auto-generated from collected registry metadata. No external claims are inferred.
Maintainers
Frequently asked questions
Should I use which?
Yes — which scores well across adoption, maintenance, weight, supply chain, and licensing. 290.2M downloads per week and 9 known dependents. Last published 124 days ago. 4 releases in the last 2 years.
How do I install which?
Run `npm install which` to add which to your npm project.
How many dependencies does which have?
which declares 4 direct dependencies and pulls in 1 packages in total once its runtime tree is resolved totalling about 70 KB on disk.
What license is which released under?
which is distributed under the ISC license.
How popular is which?
which has approximately 290,160,551 downloads per week and 9 known dependent packages.
Is which still maintained?
The most recent release of which (v7.0.0) was published 4 months ago.
Does which run install scripts?
No. which does not define preinstall, install, or postinstall scripts, so installing it does not execute publisher-supplied code.