Can be installed and run globally
Why it matters
If npx my-cli-tool fails, ninety percent of prospective users never try the tool again. Missing files causes npm to publish test fixtures, node_modules snapshots, and local .env files — leaking secrets and bloating the package from 50KB to 50MB. Missing engines means a user on Node 14 runs npx mytool and sees a cryptic SyntaxError: Unexpected token '?' from optional chaining in your ES2020 code. Missing bin means there's no command to run at all.
Severity rationale
High because distribution config errors block global installation and can leak secrets or fail on common runtime versions.
Remediation
Configure package.json with name, bin, files, and engines, and test the full publish flow locally before pushing. Verify with npm pack && npm install -g ./my-cli-tool-1.0.0.tgz && mytool --version:
{
"name": "my-cli-tool",
"bin": { "mytool": "./dist/cli.js" },
"files": ["dist"],
"engines": { "node": ">=18" }
}
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the CLI Quality Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
Taxons
History
- 2026-04-18·v1.0.0·Initial import from cli-quality·automated