# @azure/core-process

> Secure, cross-platform process launching for Node.js

Latest version **1.0.0** (published 2026-08-13) · MIT license · 0 weekly downloads

## Install

```sh
npm install @azure/core-process
pnpm add @azure/core-process
yarn add @azure/core-process
bun add @azure/core-process
```

## Health

**Score 70/100 (B)** — status: active.

Positive: has types; esm support; no vulnerabilities; recently updated; high maintenance score; high quality score.

Warnings: low downloads.

## Facts

| | |
|---|---|
| Version | 1.0.0 |
| Published | 2026-08-13 |
| First published | 2026-08-13 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | ESM + CommonJS |
| Node | >=22.0.0 |
| Dependencies | 0 |
| Unpacked size | 186.9 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 2296 |
| Author | Microsoft Corporation |
| Maintainers | azure-sdk, microsoft1es, microsoft-oss-releases |
| Keywords | node, azure, cloud, process, spawn, security |

## Links

- npm: https://www.npmjs.com/package/@azure/core-process
- Repository: https://github.com/Azure/azure-sdk-for-js
- Homepage: https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/core/core-process
- Issues: https://github.com/Azure/azure-sdk-for-js/issues
- npm.io page: https://npm.io/package/@azure/core-process

## Alternatives

- [@expo/fingerprint](https://npm.io/package/@expo/fingerprint.md) — 6.2M weekly downloads
- [@azure/monitor-opentelemetry-exporter](https://npm.io/package/@azure/monitor-opentelemetry-exporter.md) — 850.0K weekly downloads
- [@azure/monitor-opentelemetry](https://npm.io/package/@azure/monitor-opentelemetry.md) — 624.0K weekly downloads
- [@posthog/ai](https://npm.io/package/@posthog/ai.md) — 423.3K weekly downloads
- [fakefilter](https://npm.io/package/fakefilter.md) — 63.9K weekly downloads

## Recent versions

- 1.0.0 (latest) — 2026-08-13

## README

# Azure Core Process client library for JavaScript

`@azure/core-process` provides Node.js process-launching primitives that avoid
ambient shell parsing. It is intended for Azure SDK packages and tools that
need to invoke external executables on Windows, macOS, or Linux.

## Getting started

### Install the package

```bash
npm install @azure/core-process
```

### Prerequisites

- [LTS versions of Node.js](https://github.com/nodejs/release#release-schedule).

## Key concepts

Commands and arguments are always supplied separately. The package does not
provide a command-string API and does not allow callers to enable a shell.

```ts snippet:ReadmeSampleRunExecutable
import { execFile } from "@azure/core-process";

const { stdout } = await execFile("git", ["rev-parse", "--show-toplevel"]);
console.log(stdout);
```

On Windows, native `.exe` and `.com` files are preferred. Batch files are
disabled by default because arbitrary arguments cannot be transported safely
through every `.cmd` or `.bat` wrapper. A caller that expects a batch shim can
opt into the restricted batch path:

```ts snippet:ReadmeSampleRunWindowsBatchFile
import { execFile } from "@azure/core-process";

const { stdout } = await execFile("npm", ["--version"], {
  allowWindowsBatchFiles: true,
});
console.log(stdout);
```

The restricted batch path rejects command operators, variable expansion,
newlines, and other values that cannot be proven safe before `cmd.exe` starts.
If an application needs to pass those values, it must invoke a native
executable or interpreter entry point directly.

## Security boundary

This package prevents command-line data from being interpreted by an ambient
operating-system shell. It does not establish that an executable found on
`PATH` is trustworthy, sanitize code intentionally passed to an interpreter,
or prevent command-specific option injection.

Do not place secrets in command-line arguments. Process arguments may be
visible to other local processes and operating-system diagnostics.

## Troubleshooting

An unsafe Windows batch argument fails with a `ProcessError` before the child
process is created. Prefer a native executable when the argument cannot be
changed.

## Contributing

See the [contributing guide](https://github.com/Azure/azure-sdk-for-js/blob/main/CONTRIBUTING.md).

---
_Source: https://npm.io/package/@azure/core-process · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._