
Product
Rubygems Ecosystem Support Now Generally Available
Socket's Rubygems ecosystem support is moving from beta to GA, featuring enhanced security scanning to detect supply chain threats beyond traditional CVEs in your Ruby dependencies.
@guptasiddhant/react-ui
Advanced tools
Thought it is simple to publish a rudimentary NPM package, there are a lot of pitfalls. The following guide only covers the basics. For more advanced and thorough guide, check out guide by Matt Pocock at TotalTypescript. It contains steps for tooling like linting with ESlint, formatting with Prettier, testing with Vitest and more.
As a DDP member, you can also clone/fork this repository to get started. You can also use this repository as a template
to make sure you get clean setup without any backlinks to this repo.
Follow guide at end to setup Git for your package
git
, if not already installed. Note: It is not required if the code is not published to a Git service like GitHub.Create a new directory/folder in your local machine. The name could match the intended package name.
Open the new directory/folder in either Terminal or VSCode.
Create following files which are needed for building/publishing the package.
package.json
npm init
command in your directory.{
"name": "@<username>/<package-name>",
"version": "0.0.0",
"type": "module",
"description": "Description of your project",
"author": "Your name",
"repository": "github-url",
"license": "MIT",
"sideEffects": false,
"publishConfig": {
"access": "public"
},
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"exports": {
"./package.json": "./package.json",
".": {
"types": "./dist/index.d.ts",
"default": "./dist/index.js"
}
},
"scripts": {
"build": "tsc",
"dev": "tsc -w",
"start": "node dist/index.js"
},
"devDependencies": {
"typescript": "^5.0.0"
}
}
tsconfig.json
npx tsc --init
command in your directory.{
"include": ["src"],
"exclude": ["node_modules", "dist"],
"compilerOptions": {
"target": "ES2020",
"module": "NodeNext",
"outDir": "dist",
"rootDir": "src",
"jsx": "react-jsx",
"sourceMap": true,
"declaration": true,
"strict": true,
"noImplicitAny": true,
"isolatedModules": true,
"verbatimModuleSyntax": true,
"esModuleInterop": true,
"skipLibCheck": true,
"resolveJsonModule": true,
"moduleDetection": "force"
}
}
.npmrc
//registry.npmjs.org/:_authToken="<YOUR_NPM_TOKEN>"
src/index.ts
npm install
in directory to install dependenciesnpm run build
to build the packagenpm publish
to publish package. (make sure .npmrc
file exist before publishing.)Add file .gitignore
to package with following content:
node_modules
dist
.env*
!.env.sample
.npmrc
.DS_Store
Add file publish.yaml
in folder .github/workflows
in your package folder with following content:
name: Publish
on:
push:
branches:
- "main"
env:
NPM_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
publish:
permissions:
contents: read
id-token: write
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup node
uses: actions/setup-node@v4
with:
node-version: 20
cache: "npm"
- name: Setup NPM TOKEN
run: echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" > ~/.npmrc
- name: Install dependencies
run: npm ci
- name: Build package
run: npm build
- name: Publish to NPM
run: npm publish
Create an account on GitHub.
Create a new repository on GitHub.
Add NPM AuthToken to Github secrets
.npmrc
Run other commands as instructed by GitHub to link the package with Github, like
git init
git add --all
git commit -m "init commit"
git remote add origin ....
# replace .... with your git url.git branch -M main
git push -u origin main
FAQs
Description of your project
The npm package @guptasiddhant/react-ui receives a total of 0 weekly downloads. As such, @guptasiddhant/react-ui popularity was classified as not popular.
We found that @guptasiddhant/react-ui demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Product
Socket's Rubygems ecosystem support is moving from beta to GA, featuring enhanced security scanning to detect supply chain threats beyond traditional CVEs in your Ruby dependencies.
Research
The Socket Research Team investigates a malicious npm package that appears to be an Advcash integration but triggers a reverse shell during payment success, targeting servers handling transactions.
Security Fundamentals
The Socket Threat Research Team uncovers how threat actors weaponize shell techniques across npm, PyPI, and Go ecosystems to maintain persistence and exfiltrate data.