
Security News
PodRocket Podcast: Inside the Recent npm Supply Chain Attacks
Socket CEO Feross Aboukhadijeh discusses the recent npm supply chain attacks on PodRocket, covering novel attack vectors and how developers can protect themselves.
@boundaryml/baml-core-ffi
Advanced tools
@napi-rs/package-template
Template project for writing node packages with napi-rs.
yarn install
to install dependencies.npx napi rename -n [name]
command under the project folder to rename your package.yarn add @napi-rs/package-template
node14 | node16 | node18 | |
---|---|---|---|
Windows x64 | ✓ | ✓ | ✓ |
Windows x32 | ✓ | ✓ | ✓ |
Windows arm64 | ✓ | ✓ | ✓ |
macOS x64 | ✓ | ✓ | ✓ |
macOS arm64 | ✓ | ✓ | ✓ |
Linux x64 gnu | ✓ | ✓ | ✓ |
Linux x64 musl | ✓ | ✓ | ✓ |
Linux arm gnu | ✓ | ✓ | ✓ |
Linux arm64 gnu | ✓ | ✓ | ✓ |
Linux arm64 musl | ✓ | ✓ | ✓ |
Android arm64 | ✓ | ✓ | ✓ |
Android armv7 | ✓ | ✓ | ✓ |
FreeBSD x64 | ✓ | ✓ | ✓ |
After yarn build/npm run build
command, you can see package-template.[darwin|win32|linux].node
file in project root. This is the native addon built from lib.rs.
With ava, run yarn test/npm run test
to testing native addon. You can also switch to another testing framework if you want.
With GitHub Actions, each commit and pull request will be built and tested automatically in [node@14
, node@16
, @node18
] x [macOS
, Linux
, Windows
] matrix. You will never be afraid of the native addon broken in these platforms.
Release native package is very difficult in old days. Native packages may ask developers who use it to install build toolchain
like gcc/llvm
, node-gyp
or something more.
With GitHub actions
, we can easily prebuild a binary
for major platforms. And with N-API
, we should never be afraid of ABI Compatible.
The other problem is how to deliver prebuild binary
to users. Downloading it in postinstall
script is a common way that most packages do it right now. The problem with this solution is it introduced many other packages to download binary that has not been used by runtime codes
. The other problem is some users may not easily download the binary from GitHub/CDN
if they are behind a private network (But in most cases, they have a private NPM mirror).
In this package, we choose a better way to solve this problem. We release different npm packages
for different platforms. And add it to optionalDependencies
before releasing the Major
package to npm.
NPM
will choose which native package should download from registry
automatically. You can see npm dir for details. And you can also run yarn add @napi-rs/package-template
to see how it works.
Rust
Node.js@10+
which fully supported Node-API
yarn@1.x
And you will see:
$ ava --verbose
✔ sync function from native code
✔ sleep function from native code (201ms)
─
2 tests passed
✨ Done in 1.12s.
Ensure you have set your NPM_TOKEN in the GitHub
project setting.
In Settings -> Secrets
, add NPM_TOKEN into it.
When you want to release the package:
npm version [<newversion> | major | minor | patch | premajor | preminor | prepatch | prerelease [--preid=<prerelease-id>] | from-git]
git push
GitHub actions will do the rest job for you.
FAQs
Template project for writing node package with napi-rs
The npm package @boundaryml/baml-core-ffi receives a total of 22 weekly downloads. As such, @boundaryml/baml-core-ffi popularity was classified as not popular.
We found that @boundaryml/baml-core-ffi demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Socket CEO Feross Aboukhadijeh discusses the recent npm supply chain attacks on PodRocket, covering novel attack vectors and how developers can protect themselves.
Security News
Maintainers back GitHub’s npm security overhaul but raise concerns about CI/CD workflows, enterprise support, and token management.
Product
Socket Firewall is a free tool that blocks malicious packages at install time, giving developers proactive protection against rising supply chain attacks.