Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
@appmate/wishlist-hydrogen
Advanced tools
Scaffold TypeScript npm packages using this template to bootstrap your next library.
This project includes:
The following tasks are available for npm run
:
dev
: Run Rollup in watch mode to detect changes to files during developmentbuild
: Run Rollup to build a production release distributablebuild:types
: Run Microsoft API Extractor to rollup a types declaration (d.ts
) filedocs
: Run TypeDoc for TSDoc generated documentation in the "docs/" folderclean
: Remove all build artifactsWhile test driven development (TDD) would be a good approach to develop your library, also consider creating an app for prototyping and local testing of your library.
To test within the library, consider using Storybook. This approach runs a storybook
script to load local source files for development.
Otherwise, follow these steps to test the package from another project:
From your library project, issue the npm link
(or yarn link
) command:
npm link
Start Rollup in watch mode:
npm run dev
Create a test app project, by doing the following:
To use your npm package library locally for development, create a new project in a separate folder:
mkdir test-app && cd test-app
npm init
Take the defaults from npm init
; then, add TypeScript:
npm install typescript --save-dev
In the package.json of your test app, add the following two things:
type
of your package to module
start
script to execute your app"type": "module",
"scripts": {
"start": "tsc && node index.js",
},
Link to your library using the npm link <name>
(or yarn link <name>
) command - be sure the <name>
matches your library's package.json name. For example:
npm link typescript-npm-package
Add a "tsconfig.json" file to your test app that includes a baseUrl
and references the paths
to your npm linked module. Again, be sure the paths
name matches your library's package.json name. For example:
{
"compilerOptions": {
"target": "es6",
"module": "esnext",
"moduleResolution": "node",
"strict": true,
"esModuleInterop": true,
"baseUrl": ".",
"paths": {
"typescript-npm-package": ["node_modules/typescript-npm-package/src"],
"typescript-npm-package/*": ["node_modules/typescript-npm-package/src/*"]
}
}
}
Now, run your app via npm start
.
As an example, if your library's "index.ts" file contained:
export const sayHi = () => {
console.log("Hi");
};
...your test app would implement an import using your package name, such as:
import { sayHi } from "typescript-npm-package";
sayHi();
Once development completes, unlink
both your library and test app projects.
From your test app project, unlink the library using npm unlink <name>
(or yarn unlink <name>
) command:
npm unlink typescript-npm-package
From your library project, issue the npm unlink
(or yarn unlink
) command:
npm unlink
Update your package.json
to next version number, and remember to tag a release.
Once ready to submit your package to the NPM Registry, execute the following tasks via npm
(or yarn
):
npm run clean
— Assure a clean buildnpm run build
— Build the packagenpm run build:types
— Build API Extractor d.ts declarationAssure the proper npm login:
npm login
Submit your package to the registry:
npm publish --access public
FAQs
Wishlist King SDK for Shopify Hydrogen
The npm package @appmate/wishlist-hydrogen receives a total of 173 weekly downloads. As such, @appmate/wishlist-hydrogen popularity was classified as not popular.
We found that @appmate/wishlist-hydrogen demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.