Herozion — npm package

Binary wrapper for the Herozion CLI security scanner.

Usage without global install (recommended)

# Run directly with npx — no install, no PATH modification
npx herozion scan .

# Or as a project dev-dependency
npm install herozion --save-dev
npx herozion scan .

The binary is stored inside node_modules/herozion/bin/ — it never touches your system PATH.

Update (global install)

npm install -g herozion@latest --foreground-scripts

herozion --version reads the downloaded binary, not the npm wrapper alone. If the version does not change after update, the postinstall download was skipped — force it:

rm -rf "$(npm root -g)/herozion"
npm install -g herozion@latest --foreground-scripts
which -a herozion
herozion --version

Uninstall (global install)

npm uninstall -g herozion

If you see a binary download instead of a removal (older package versions), use:

npm uninstall -g herozion --ignore-scripts

Then verify removal:

npm list -g herozion    # should report empty
command -v herozion     # should print nothing

If the command still exists, remove leftovers manually:

rm -rf "$(npm root -g)/herozion"
rm -f "$(npm bin -g)/herozion"

Full documentation

See github.com/Herozion/scanner