
Security News
Google’s OSV Fix Just Added 500+ New Advisories — All Thanks to One Small Policy Change
A data handling bug in OSV.dev caused disputed CVEs to disappear from vulnerability feeds until a recent fix restored over 500 advisories.
@inspectr/go-npm
Advanced tools
A package to publish go binaries via npm.
npm publish
npm install/update -g your-awesome-app
This package is a fork of go-npm. This fork updates the logic to use minimal dependencies, support for installation on arm64 architectures. Big thanks to the previous author and help save his son
NB: This package is for publishing global binaries. i.e. binaries installed with -g
flag.
Start by creating a package.json
npm init
Follow the prompts and fill them with your own preferred fields. Mine looks like:
{
"name": "app",
"version": "0.1.0",
"description": "Example App",
"main": "index.js",
"scripts": {
"postinstall": "go-npm install",
"preuninstall": "go-npm uninstall",
"test": "echo \"Error: no test specified\" && exit 1"
},
"dependencies": {
"@inspectr/go-npm": "^0.1.0"
},
// Specify details about your binary
"goBinary": {
// Name of the binary file and what npm will alias as
"name": "myBinaryName",
// Where to add the binary
"path": "./bin",
// Dynamic URL pointing to where the compressed binary exists based on version, platform, and the processor type (amd64, arm, and more)
"url": "https://github.com/user/myrepo/releases/download/v{{version}}/myBinaryName_{{version}}_{{platform}}_{{arch}}.tar.gz"
}
}
You would notice there are two commands in the scripts section
"scripts": {
"postinstall": "go-npm install",
"preuninstall": "go-npm uninstall",
"test": "echo \"Error: no test specified\" && exit 1"
},
What postinstall does is that after installing the package it will pull the binary from where you saved it Github or Amazon S3,
preuninstall removes the binary from the bin directory before NPM uninstalls the package.
NB: sadly npm v7+ no longer supports uninstall scripts so preuninstall
won't work. Reason here
To confirm if everything is working properly up to this point. You run:
npm i @inspectr/go-npm
This will create a node_modules folder, add it to your .gitignore file, to avoid pushing it to Github.
For our CLI tool to work on all operating systems, we need to build a binary that works for each using Goreleaser
To install GoReleaser visit this link.
Before we can build our OS-specific binaries we need the following:
Creating our token
export GITHUB_TOKEN=<YOUR GITHUB TOKEN>
Tagging a release
We need to create a tag and push it as GoReleaser will use the latest Git tag of your repo.
git tag -a <version> <commit> -m <release label>
Define goreleaser config and define the arch and operating systems you want to build for.
In your .goreleaser.yml file
builds:
- binary: <Your CLI name>
goos:
- windows
- darwin
- linux
goarch:
- amd64
- arm64
Run goreleaser
goreleaser release
The above command will publish your CLI to Github or Gitlab based on where your repo is hosted.
Next, this CLI needs to be published to npm.
Before you can do that ensure you have the following done:
npm login
And now let's publish
npm publish
You just got your package published~ Things you should note
FAQs
Distribute and install Go binaries via NPM
The npm package @inspectr/go-npm receives a total of 4 weekly downloads. As such, @inspectr/go-npm popularity was classified as not popular.
We found that @inspectr/go-npm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A data handling bug in OSV.dev caused disputed CVEs to disappear from vulnerability feeds until a recent fix restored over 500 advisories.
Research
/Security News
175 malicious npm packages (26k+ downloads) used unpkg CDN to host redirect scripts for a credential-phishing campaign targeting 135+ organizations worldwide.
Security News
Python 3.14 adds template strings, deferred annotations, and subinterpreters, plus free-threaded mode, an experimental JIT, and Sigstore verification.