
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@jakzo/package-splitter
Advanced tools
Publish a codebase as multiple packages.
You should consolidate your packages into a monorepo when you have multiple related packages which:
There are many existing monorepo tools which help you do this (eg. Lerna, Bolt, Rush). The unique benefits that Package Splitter provides are:
package.json for each package, never repeat yourself)package.json files at package boundaries and you're done)In most cases a monorepo using Package Splitter is the easiest solution, however there are times when you may need to go with a traditional monorepo tool, such as when:
In these cases you should probably use a tool like Lerna but keep in mind you can mix and match approaches depending on your needs (eg. have Lerna maintain a frontend package and a backend package, each with their own build tooling, then have these packages both use Package Splitter to further split them into many modules).
package.json file for each subpackage and place them in each subpackage's source directory. These package.json files can contain as much or as little details as you'd like. Nothing is required; anything not specified will be inferred according to the package inference rules.npm i package-splitter or yarn add package-splitterpackage-splitter publish -s INPUT_PATH_FOR_SOURCE_FILES -b INPUT_PATH_FOR_BUILT_FILES -p OUTPUT_PATH_FOR_PUBLISH_FILESAll packages have now:
For convenience there are a few behaviors configured by default. Read more about them here:
package.json fields are inferredBelow are the default values for package.json files:
| Field | Default Value | Example |
|---|---|---|
name | Path from the src directory to the package's directory. Name is converted to snake-case. | If the package.json is at src/esky/lid/package.json, then the inferred package name will be esky-lid. |
version | The latest version published on npm, or 0.0.1 if it is not published. | |
dependencies | Packages which are imported in the code are added to the list of dependencies. | If the package has a source file containing import x from 'some-module'; then some-module will be added to dependencies. |
engines | The engines field of the parent package.json. | If the root package.json has "engines": { "node": "12" } then a package will inherit the same engines value. |
type | The type field of the parent package.json. | If the root package.json has "type": "module" then a package will inherit the same type value. |
Dependencies
The dependencies, peerDependencies and optionalDependencies fields require some extra explanation.
.js, .jsx, .ts, .tsx) within the package are scanned for imported packages (through import statements, dynamic import statements and require calls where the argument is a string literal)dependencies field whether or not the dependencies field already exists in the package.jsonpackage.json file which contains the dependency in a dependencies, peerDependencies or optionalDependencies fielddependencies, peerDependencies or optionalDependencies, it will not be added to dependenciesdependencies, peerDependencies or optionalDependencies as null (eg. "dependencies": { "some-module": null }) then the version will be replaced with the version from the nearest parent package.json fileWhen publishing a package, the following things happen when there is no version field in its package.json:
version of the packagerelease: MAJOR - majorfeat: - minorFAQs
Publish a codebase as multiple packages.
We found that @jakzo/package-splitter demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.