🚨 Shai-Hulud Strikes Again:834 Packages Compromised.Technical Analysis
Socket
Book a DemoInstallSign in
Socket

@hubspot/npm-scripts

Package Overview
Dependencies
Maintainers
33
Versions
12
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

@hubspot/npm-scripts

Scripts for working with npm packages in the HubSpot ecosystem

next
latest
npmnpm
Version
0.0.5
Version published
Weekly downloads
18
100%
Maintainers
33
Weekly downloads
 
Created
Source

@hubspot/npm-scripts

A collection of scripts for internal HubSpot npm package development and management.

Tools

Package Linking Tool (hubspot-linking)

The linking tool helps manage symlinked HubSpot packages in your development environment. It provides an interactive way to link and unlink local copies of @hubspot packages.

Usage

It can be used via npx

npx @hubspot/npm-scripts hubspot-linking

Or installed as a part of the project and used in the package.json

{
  "dependencies": {
    "@hubspot/npm-scripts": "latest"
  },
  "scripts": {
    "local-link": "hubspot-linking"
  }
}

Prerequisites

  • Run yarn link from inside the local copy of any HubSpot package you want to make available for linking
  • The tool looks for packages in ~/.config/yarn/link/@hubspot/

What it does

  • Scans your project's node_modules/@hubspot directory for currently linked packages
  • Lists all available packages that can be linked (from your yarn link directory)
  • Presents a checkbox interface to select which packages to link/unlink
  • Automatically handles linking selected packages and unlinking deselected ones
  • Runs yarn install --force to ensure dependencies are properly resolved

Release Script Builder (buildReleaseScript)

A utility function that creates a comprehensive npm release script with support for different release tags and semantic versioning.

Usage

Create a release script file (e.g., scripts/release.ts):

import { buildReleaseScript } from '@hubspot/npm-scripts';
import path from 'path';

buildReleaseScript({
  packageJsonLocation: path.resolve('./package.json'),
  buildHandlerOptions: {
    repositoryUrl: 'https://github.com/your-org/your-repo',
    mainBranch: 'main', // optional, defaults to 'master'
    build: async () => {
      // Optional custom build function
      // If not provided, runs 'yarn build'
    },
    postLatestRelease: async () => {
      // Optional function to run after latest releases
    }
  }
});

Then add to your package.json:

{
  "scripts": {
    "release": "tsx ./scripts/release.ts release"
  },
  "publishConfig": {
    "registry": "https://registry.npmjs.org/"
  }
}

Release Commands

# Release a patch version to latest
yarn release -v=patch -t=latest

# Release a minor version to next (beta)
yarn release -v=minor -t=next

# Release an experimental version
yarn release -v=patch -t=experimental

# Dry run (test without publishing)
yarn release -v=patch -t=latest -d

Parameters

  • -v, --versionIncrement: SemVer increment type (patch, minor, major, prerelease)
  • -t, --tag: Release tag (latest, next, experimental)
  • -d, --dryRun: Run without actually publishing

Features

  • Branch protection: Ensures releases are made from the correct branch
  • Version validation: Checks local version against published versions
  • Interactive prompts: Confirms release details and requires 2FA codes
  • Automatic tagging: Creates git tags and pushes to repository
  • GitHub integration: Opens PR and release pages automatically
  • Rollback support: Cleans up on failure

FAQs

Package last updated on 16 Oct 2025

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts