
Security News
Feross on TBPN: Socket's Series C and the State of Software Supply Chain Security
Feross Aboukhadijeh joins TBPN to discuss Socket's $60M Series C, 500%+ ARR growth, AI's impact on open source, and the rise in supply chain attacks.
@flexbase/template-typescript-package
Advanced tools
template repo for npmjs packages utilizing typescript
golden path for writing and publishing packages at Flexbase.
The template repo has the following setup, feel free to add additional capabilities:
The goal to this approach: provide golden paths that are fully supported by Flexbase, and bring focus to the business logic, while removing manual setup and deployments.
Development of business logic lives in src.
Compilation of the app can be run with yarn build, and transpiled code lives in dist.
During development, there are placeholders that will need to be updated as a one off to make your package unique:
package.json properties: name, description, contributorshttps://sonarcloud.io/projects/create is where you can select your repo for import.Before opening a PR, commit your changes locally and update the package.json easily with npm run patch, npm run minor, and npm run major.
Confused on what version to set semantically? Check out npm's doc on semantic versioning here: https://docs.npmjs.com/about-semantic-versioning
Tests live in test.
yarn test is the main command to run tests via command line - there are also a number of .vscode launch configs that exist to support jest watch commands. The Run and Debug button on the left hand side (Activity bar) is where you can access these.
Deployments of the package are outlined in the .github/workflows. Deployments occur for the following events:
| Event | Deploy Type | Naming Convention |
|---|---|---|
| pull request | beta | <package.json.version>-beta.<github-run-number> |
| merge to main | production | <package.json.version> |
Betas allow you and other consumers to test out new releases before merging to main. When merging to main, be sure to bump the package.json version (see package.json for npm commands to bump) for your change; otherwise npmjs will reject the deployment since it prevents users from mistakenly overriding existing releases.
FAQs
template repo for npmjs packages utilizing typescript
We found that @flexbase/template-typescript-package demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Feross Aboukhadijeh joins TBPN to discuss Socket's $60M Series C, 500%+ ARR growth, AI's impact on open source, and the rise in supply chain attacks.

Security News
OSV withdrew 157 OSV malware reports after automated false positives incorrectly flagged trusted npm and PyPI packages, sending bad records into tools that rely on OSV data.

Research
/Security News
TrapDoor crypto stealer hits 36 malicious packages across npm, PyPI, and Crates.io, targeting crypto, DeFi, AI, and security developers.