
Research
/Security News
Weaponizing Discord for Command and Control Across npm, PyPI, and RubyGems.org
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
@dhis2/cli-packages
Advanced tools
Standardised tool for dealing with DHIS2 Packages.
package.json
from ${pkg}
to ${pkg}/build/
build/package.json
with private: false
and publicAccess
props${repo}/packages/
)build/
directorynpm install --save-dev @dhis2/packages
# or
yarn add -D @dhis2/packages
packages help
usage: packages <command> [options]
# ... list of commands ...
Install Husky (preferred) or another hook-manager:
npm install husky --save-dev
"husky": {
"hooks": {
"commit-msg": "packages commit-style",
"pre-commit": "packages code-style"
}
}
Once you are using those hooks, we can generate CHANGELOG.md
for each release, e.g. as we do in @dhis2/ui/CHANGELOG.md.
CHANGELOG.md
, tags, etc.We use standard-version to generate release information.
N.B.: The first time a release is cut use the first-release option: packages release --first-release
To do a subsequent release, run packages release
.
packages release help
usage: packages release [options]
[... list of options ...]
After that run git push --follow-tags origin master
. DO NOT RUN npm publish
. Travis does this when it builds a tag.
Packages supports both tools but yields to Yarn if there exists both a yarn.lock
and a package-lock.json
file.
And example implementation of a monorepo with workspaces is here: d2-ui/package.json.
The packages exec
command is important for monorepos as it runs the given command with its arguments on each of the sub-packages inside of ${repo}/packages/
.
Common configuration could be to add the following scripts:
"build": "packages build",
"watch": "packages exec yarn watch",
"lint": "packages exec yarn lint",
Packages supports monorepos without using the concept of workspaces, but it makes some assumptions about how the project is structured:
${repo}/packages/
packages install
which then runs install
in each sub-packageThe workflow would be:
packages install
packages link
packages build
packages install
takes care to first run the install
command in the ${repo}/
, and then running install
in each sub-package in parallel.
Using workspaces, a developer could simplify the workflow with the configuration:
"scripts": {
"postinstall": "packages link",
},
"workspaces": [
"packages/*",
"examples/*"
],
Yielding the workflow:
yarn install
packages build
yarn install
with workspaces enabled automatically installs all dependencies for the sub-packages in one go.
FAQs
D2 CLI module for managing npm packages
We found that @dhis2/cli-packages demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 13 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
Security News
Socket now integrates with Bun 1.3’s Security Scanner API to block risky packages at install time and enforce your organization’s policies in local dev and CI.
Research
The Socket Threat Research Team is tracking weekly intrusions into the npm registry that follow a repeatable adversarial playbook used by North Korean state-sponsored actors.