
Security News
Feross on Risky Business Weekly Podcast: npm’s Ongoing Supply Chain Attacks
Socket CEO Feross Aboukhadijeh joins Risky Business Weekly to unpack recent npm phishing attacks, their limited impact, and the risks if attackers get smarter.
This is my script for creating an npm package from a skeleton project and setting up the CI build as fast as possible. Once you've used this you'll never want to go back to setting up all of that stuff manually.
yarn global add 0-60
Or if you want you can run it with npx
:
npx 0-60
0-60 clone <REPO URL>[#<BRANCH>]
0-60
will prompt you for the new package name, organization, etc:
$ 0-60 clone https://github.com/jedwards1211/es2015-library-skeleton.git
? Destination directory: cool-project
Cloning into 'cool-project'...
remote: Enumerating objects: 182, done.
remote: Counting objects: 100% (182/182), done.
remote: Compressing objects: 100% (41/41), done.
remote: Total 1078 (delta 162), reused 150 (delta 140), pack-reused 896
Receiving objects: 100% (1078/1078), 586.17 KiB | 2.78 MiB/s, done.
Resolving deltas: 100% (724/724), done.
? Package name: cool-project
? Package description: made with 0-60!
? Package author: Andy Edwards
? Package keywords: foo,bar
? GitHub organization: jedwards1211
? GitHub repo: cool-project
Installing dependencies...
yarn install v1.13.0
[1/4] 🔍 Resolving packages...
[2/4] 🚚 Fetching packages...
[3/4] 🔗 Linking dependencies...
[4/4] 🔨 Building fresh packages...
✨ Done in 9.17s.
Ready to go!
You don't have to type the repository URL every time. Instead you can configure
a preset list of repositories to pick from by adding them to ~/.0-60.json
.
Then just run 0-60
without arguments, and outside of a repo directory.
0-60
will prompt you to select which skeleton you want from this list.
Example ~/.0-60.json
:
{
"skeletons": [
"jedwards1211/es2015-library-skeleton",
"jedwards1211/react-library-skeleton",
"jedwards1211/react-karma-library-skeleton",
"jedwards1211/untranspiled-js-library-skeleton",
"jedwards1211/typescript-library-skeleton",
"jedwards1211/typescript-library-skeleton#pnpm"
]
}
$ 0-60
? Skeleton repo: (Use arrow keys)
❯ jedwards1211/es2015-library-skeleton
jedwards1211/react-library-skeleton
jedwards1211/react-karma-library-skeleton
jedwards1211/untranspiled-js-library-skeleton
jedwards1211/typescript-library-skeleton
jedwards1211/typescript-library-skeleton#pnpm
Running 0-60
inside in your repo directory will:
.travis.yml
is present)Just run git pull skeleton master
(0-60
keeps the skeleton repository URL in the skeleton
remote).
I recommend using the CLI in my fork of merge-package.json to automatically fix merge conflicts in package.json
. (Install with npm i -g jedwards1211/merge-package.json#cli
and then just run merge-package.json
in the project directory after pulling.)
FAQs
clone a skeleton repo and set up CI build as fast as possible
We found that 0-60 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Socket CEO Feross Aboukhadijeh joins Risky Business Weekly to unpack recent npm phishing attacks, their limited impact, and the risks if attackers get smarter.
Product
Socket’s new Tier 1 Reachability filters out up to 80% of irrelevant CVEs, so security teams can focus on the vulnerabilities that matter.
Research
/Security News
Ongoing npm supply chain attack spreads to DuckDB: multiple packages compromised with the same wallet-drainer malware.