
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@invisible/publish
Advanced tools
Asserts a version bump and publishes your package to npm automatically
Asserts a version bump and publishes your package to npm automatically.
yarn add -D @invisible/publish
# or
npm install -D @invisible/publish
'use strict'
const {
assertVersionBump,
publish,
} = require('@invisible/publish')
const newRelease = async () => {
{
// fileName defaults to 'package.json' if no argument given.
// This method return a promise of an object with pass and msg as keys.
const { pass, msg } = await assertVersionBump({ fileName: 'package.json' })
// You can process the results as you wish. As an example, you can consume it like below:
if (msg) console.log(`assert-version-bump: ${msg}`)
if (! pass) process.exit(1)
}
{
const { NPM_TOKEN, NPMRC_DIR } = process.env
// NPMRC_DIR defaults to 'process.env.HOME' if no argument given.
// This method return an object with pass and msg as keys.
const { pass, msg } = publish({ NPM_TOKEN, NPMRC_DIR })
// You can process the results as you wish. As an example, you can consume it like below:
if (msg) console.log(`publish: ${msg}`)
if (pass) process.exit(0)
process.exit(1)
}
}
newRelease()
Add assert-version-bump to your package posttest script in package.json:
// It would look something like:
"scripts": {
"posttest": "assert-version-bump"
}
You can also run it at any time from your CLI.
$ assert-version-bump # will output the change if found
$ assert-version-bump --quiet # will silently succeed, but output error if not found
package.json"scripts": {
"posttest": "assert-version-bump manifest.json"
}
publish to the commands on deployment section of your package circle.yml:# It would look something like:
deployment:
release:
branch: master
commands:
- publish
NPM_TOKEN environmental variable is required for publishing. See Miscellaneous Information to know options on how to add it.
You can also run it at any time from your CLI. Just make sure you are on master branch and have a ~/.npmrc file with a valid token.
$ publish
$ publish --quiet # will silently succeed, but output error.
Add NPM_TOKEN environmental variable to your package on circleCI.
To do this you will have to:
https://circleci.com/gh/invisible-tech/<your-package-name>/edit#env-vars (replace <your-package-name>, e.g. merge-parsers)Import Variable(s).NPM_TOKEN.
You can add NPM_TOKEN to your .env file and install dotenv as dependency/devDependency.
If you are having problems, it probably is because you don't have your package .bin folder set on PATH.
machine:
environment:
# For yarn
PATH: "${PATH}:${HOME}/${CIRCLE_PROJECT_REPONAME}/node_modules/.bin"
assert-version-bump does not work on the first PR because it asserts through diff of HEAD and last merge commit.
Make assert-version-bump work since first PR.
MIT
FAQs
Asserts a version bump and publishes your package to npm automatically
The npm package @invisible/publish receives a total of 13 weekly downloads. As such, @invisible/publish popularity was classified as not popular.
We found that @invisible/publish demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 8 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.