
Security Fundamentals
Turtles, Clams, and Cyber Threat Actors: Shell Usage
The Socket Threat Research Team uncovers how threat actors weaponize shell techniques across npm, PyPI, and Go ecosystems to maintain persistence and exfiltrate data.
@guptasiddhant/react-ui
Advanced tools
Thought it is simple to publish a rudimentary NPM package, there are a lot of pitfalls. The following guide only covers the basics. For more advanced and thorough guide, check out guide by Matt Pocock at TotalTypescript. It contains steps for tooling like linting with ESlint, formatting with Prettier, testing with Vitest and more.
As a DDP member, you can also clone/fork this repository to get started. You can also use this repository as a template
to make sure you get clean setup without any backlinks to this repo.
Follow guide at end to setup Git for your package
git
, if not already installed. Note: It is not required if the code is not published to a Git service like GitHub.Create a new directory/folder in your local machine. The name could match the intended package name.
Open the new directory/folder in either Terminal or VSCode.
Create following files which are needed for building/publishing the package.
package.json
npm init
command in your directory.{
"name": "@<username>/<package-name>",
"version": "0.0.0",
"type": "module",
"description": "Description of your project",
"author": "Your name",
"repository": "github-url",
"license": "MIT",
"sideEffects": false,
"publishConfig": {
"access": "public"
},
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"exports": {
"./package.json": "./package.json",
".": {
"types": "./dist/index.d.ts",
"default": "./dist/index.js"
}
},
"scripts": {
"build": "tsc",
"dev": "tsc -w",
"start": "node dist/index.js"
},
"devDependencies": {
"typescript": "^5.0.0"
}
}
tsconfig.json
npx tsc --init
command in your directory.{
"include": ["src"],
"exclude": ["node_modules", "dist"],
"compilerOptions": {
"target": "ES2020",
"module": "NodeNext",
"outDir": "dist",
"rootDir": "src",
"jsx": "react-jsx",
"sourceMap": true,
"declaration": true,
"strict": true,
"noImplicitAny": true,
"isolatedModules": true,
"verbatimModuleSyntax": true,
"esModuleInterop": true,
"skipLibCheck": true,
"resolveJsonModule": true,
"moduleDetection": "force"
}
}
.npmrc
//registry.npmjs.org/:_authToken="<YOUR_NPM_TOKEN>"
src/index.ts
npm install
in directory to install dependenciesnpm run build
to build the packagenpm publish
to publish package. (make sure .npmrc
file exist before publishing.)Add file .gitignore
to package with following content:
node_modules
dist
.env*
!.env.sample
.npmrc
.DS_Store
Add file publish.yaml
in folder .github/workflows
in your package folder with following content:
name: Publish
on:
push:
branches:
- "main"
env:
NPM_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
publish:
permissions:
contents: read
id-token: write
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup node
uses: actions/setup-node@v4
with:
node-version: 20
cache: "npm"
- name: Setup NPM TOKEN
run: echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" > ~/.npmrc
- name: Install dependencies
run: npm ci
- name: Build package
run: npm build
- name: Publish to NPM
run: npm publish
Create an account on GitHub.
Create a new repository on GitHub.
Add NPM AuthToken to Github secrets
.npmrc
Run other commands as instructed by GitHub to link the package with Github, like
git init
git add --all
git commit -m "init commit"
git remote add origin ....
# replace .... with your git url.git branch -M main
git push -u origin main
FAQs
Description of your project
The npm package @guptasiddhant/react-ui receives a total of 0 weekly downloads. As such, @guptasiddhant/react-ui popularity was classified as not popular.
We found that @guptasiddhant/react-ui demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security Fundamentals
The Socket Threat Research Team uncovers how threat actors weaponize shell techniques across npm, PyPI, and Go ecosystems to maintain persistence and exfiltrate data.
Security News
At VulnCon 2025, NIST scrapped its NVD consortium plans, admitted it can't keep up with CVEs, and outlined automation efforts amid a mounting backlog.
Product
We redesigned our GitHub PR comments to deliver clear, actionable security insights without adding noise to your workflow.