
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
@ariestools/toolchain
Advanced tools
Unified TypeScript toolchain for XY Labs — build, lint, test, deploy with auto-detected package manager and React support
Unified TypeScript toolchain for XY Labs — build, lint, test, deploy with auto-detected package manager and React support
Using npm:
npm install {{name}}
Using yarn:
yarn add {{name}}
Using pnpm:
pnpm add {{name}}
Using bun:
bun add {{name}}
package-compile / package-build / package-recompileTo add steps to a per-package build phase, override the matching script in your package's package.json and chain to the toolchain default via the matching -only bin:
{
"scripts": {
"package-compile": "package-compile-only && tsx scripts/generate-types.ts"
}
}
Do not call pnpm package-compile / yarn package-compile / pnpm run package-compile from the override — those re-enter the same npm script and recurse infinitely. The -only bin variants exist precisely so your override can invoke the toolchain default once and add work around it.
Available -only variants: package-compile-only, package-build-only, package-recompile-only.
Monolith packages can copy already-built runtime files into exact public output
paths without a package-local post-processing script. Configure
compile.monolith.copyEntries as platform → output path → source:
import type { XyConfig } from '@ariestools/toolchain'
const config: XyConfig = {
compile: {
mode: 'monolith',
monolith: {
copyEntries: {
neutral: {
'hash/worker/subtleHash-bundle.mjs':
'@xyo-network/sdk-protocol-core/hash/worker/subtleHash-bundle.mjs',
},
},
modules: [
{
name: 'hash',
export: true,
reexport: '@xyo-network/sdk-protocol-core/hash',
},
],
platforms: ['neutral'],
},
},
}
export default config
The example copies the dependency export byte-for-byte to
dist/neutral/hash/worker/subtleHash-bundle.mjs. The output key is also the
subpath suggested by xy publint --fix, so the corresponding package export is
./hash/worker/subtleHash-bundle.mjs.
Sources may be package export specifiers, paths relative to the compiling
package, or absolute paths. Copying runs only during emit, after normal monolith
compilation; --validate-only does not resolve or copy the configured sources.
Destinations must remain inside their configured dist/<platform> directory.
See the LICENSE file for license rights and limitations (LGPL-3.0-only).
FAQs
Unified TypeScript toolchain for XY Labs — build, lint, test, deploy with auto-detected package manager and React support
The npm package @ariestools/toolchain receives a total of 1,475 weekly downloads. As such, @ariestools/toolchain popularity was classified as popular.
We found that @ariestools/toolchain demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.