
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@hakobu/hakobu
Advanced tools
The modern Node.js packager — the successor to @yao-pkg/pkg. Package your Node.js project into a standalone executable that runs without Node.js installed.
npm install @hakobu/hakobu --save-dev
Or globally:
npm install -g @hakobu/hakobu
# Package the current project
npx @hakobu/hakobu .
# Package with a specific target
npx @hakobu/hakobu . --target node24-linux-x64
# Multi-target build
npx @hakobu/hakobu . --target node24-linux-x64,node24-macos-arm64,node24-win-x64
hakobu <project-root> [options]
Commands:
hakobu <project-root> Package a project
hakobu targets Show available targets and cache
hakobu inspect <project-root> Analyze a project without packaging
hakobu doctor <project-root> Check if a project is ready to package
Options:
--target <spec> Target(s), comma-separated. Use 'all' for all published targets
--output <path> Output executable path
--entry <file> Entry file (relative to project root)
--debug, -d Show detailed packaging diagnostics
--help, -h Show help
--version, -v Show version
Bundle Mode:
--bundle [name] Pre-bundle with Rolldown before packaging
--external <mod> Keep module external when bundling (repeatable)
Advanced:
--bytecode Compile JS to V8 bytecode before packaging
--compress <algo> Compress snapshot (Brotli or GZip)
--options <flags> Bake V8 flags into executable (comma-separated)
--build, -b Force local build of base binary
Target format: node24-{platform}-{arch}
| Target | Tier |
|---|---|
| node24-linux-x64 | 1 |
| node24-linux-arm64 | 1 |
| node24-win-x64 | 1 |
| node24-macos-arm64 | 1 |
| node24-macos-x64 | 2 |
| node24-linuxstatic-x64 | 2 |
| node24-win-arm64 | 2 |
Use --target all to build for all published targets.
Configure via the "hakobu" field in package.json:
{
"hakobu": {
"entry": "src/index.js",
"assets": ["templates/**", "views/**"],
"target": "node24-linux-x64",
"output": "dist/my-app"
}
}
The legacy "pkg" field is accepted with migration warnings. CLI flags override package.json config.
For TypeScript and monorepo projects, use --bundle to pre-bundle with Rolldown before packaging:
npx @hakobu/hakobu . --bundle --entry src/cli.ts --external electron
See Bundle Mode documentation for details.
npx @hakobu/hakobu . --target node24-macos-arm64 \
--sign-identity "Developer ID Application: ..." \
--notarize
npx @hakobu/hakobu . --target node24-macos-arm64 \
--app-bundle --bundle-id com.example.my-app
npx @hakobu/hakobu . --target node24-win-x64 \
--product-name "My App" \
--company-name "My Company" \
--file-version 1.0.0 \
--icon app.ico
npx @hakobu/hakobu . --target node24-linux-x64 \
--appdir --desktop-name "My App"
npx @hakobu/hakobu . --target node24-linux-x64 \
--appimage --desktop-name "My App"
import { exec } from '@hakobu/hakobu';
await exec(['.', '--target', 'node24-linux-x64', '--output', 'dist/app']);
npm uninstall @yao-pkg/pkg
npm install @hakobu/hakobu --save-dev
Rename the "pkg" field to "hakobu" in your package.json. The legacy "pkg" field still works with migration warnings.
See the Migration Guide for full details.
MIT
FAQs
Package your Node.js project into an executable
We found that @hakobu/hakobu demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.