
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@jakzo/testpkg
Advanced tools
JavaScript Technology Manager -- project tooling in a box. Preconfigured tools like Webpack, TypeScript, Jest, Github Actions and more set up and upgraded with a single command.
Warning: this project is still in beta. Until it reaches v1.0.0 there will likely be breaking changes which require manual fixes.
Create an empty directory for your new project then run:
yarn add --exact --dev @jstm/preset-node
That's it! After a few prompts all the tooling should now be set up. Note that you may need to restart your IDE for the integrations to pick up the changes to tooling (eg. for the VSCode ESLint plugin to read the newly created config).
yarn add --exact --dev @jstm/preset-node # install in project, --exact is recommended to ensure version matches what you expect
yarn upgrade @jstm/preset-node --latest # update to latest project tooling
yarn project # manually sync tooling into project
If you want to add this to an existing project you can run the same command to install all the tooling. Existing tooling files will be overwritten so make sure you're using version control like Git so you can restore anything deleted if necessary. Carefully review all the changes which were made to make sure you don't lose anything. Some common things you will have to do are:
.eslintrc.js file but your project had a .eslintrc.json file it will not be overwritten and you will have to manually delete the old file.build, test, etc.) to custom scripts (eg. build:custom, test:custom, etc.).There are multiple templates available. To use a particular template, simply install it as a dev dependency into your project then run yarn project and it will set itself up.
These packages are:
@jstm/preset-node - Preconfigured tooling for Node.js projects.Configuration values for jstm are stored in PROJECT_ROOT/config/.jstmrc.json. This file contains things like the name of your project's main git branch (eg. master or main) or the minimum supported node version of your project. If this file does not exist you will be prompted for values for missing configuration items. After going through the prompts this file will be automatically created for you. Any config items missing from your .jstmrc.json will use jstm's default values.
While you can configure a lot of different things, it is recommended you choose the defaults as much as possible. One of the main benefits of jstm is that it automatically upgrades your tooling config, but if you manually specify config values you will need to update them yourself. For example, if you set nodeMinVersion to 13 when the default is 12, eventually node 12 will reach its end-of-life and jstm will have the default bumped to version 14, but your project will still be using version 13 until you update it yourself.
For free maintainence. This tool is more than just a set of file templates; all the tooling and configuration is encapsulated inside a dependency which means that by running yarn upgrade @jstm/preset-node --latest your tooling will be updated to the current state-of-the-art JS project setup. These upgrades can even be automated with a bot like Renovate. With file templates they help you get started quickly but leave all the maintenance to you. If you have many separate repositories, the maintenance time savings add up quickly.
If you require a unique tooling setup which is not compatible with any available project templates. Right now there is only a narrow set of templates with my preferred tooling setup (generally uses tools which are popular for OSS projects). However you can also:
config directory@jstm/coreThis is a manual process for now. To do this you should:
@jstm/preset-nodeyarn remove @jstm/preset-node.gitignoreSee CONTRIBUTING.md for instructions how to develop locally and make changes.
FAQs
JavaScript Technology Manager -- project tooling in a box.
We found that @jakzo/testpkg demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.