
Security News
Another Round of TEA Protocol Spam Floods npm, But It’s Not a Worm
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.
@mlaursen/release-script
Advanced tools
The release script I normally use for packages I publish to npm
This is the normal npm release script I use. This requires:
GITHUB_TOKEN in an .env.local file that
should not be committedThe release script relies on changesets to handle bumping versions and generating changelogs.
pnpm install --save-dev @mlaursen/release-script \
@changesets/cli \
tsx
Setup the .changeset dir if needed:
pnpm changeset init
git add .changeset
git add -u
git commit -m "build: setup changesets"
Create a scripts/release.ts file with:
import { release } from "@mlaursen/release-script";
await release({
repo: "{{REPO_NAME}}", // i.e. eslint-config
// if the repo is not under `mlaursen` for some reason
// owner: "mlaursen",
// If there is a custom clean command for releases. `clean` is the default
// cleanCommand: "clean",
// If there is a custom build command for releases. `build` is the default
// buildCommand: "build",
// An optional flag if the build step should be skipped. `!buildCommand` by default
// skipBuild: process.argv.includes("--skip-build"),
// This is useful for monorepos where only a single Github release needs to
// be created. Defaults to `JSON.parse(await readFile("package.json)).name`
// mainPackage: "{{PACKAGE_NAME}}",
// If the version message needs to be customized. The following is the default
// versionMessage: "build(version): version package",
// An optional `.env` file path that includes the `GITLAB_TOKEN` environment
// variable.
// envPath: ".env.local",
// An optional async function to get the next release tag name. The default
// is shown below:
// getTagName: async () => {
// const latestTag = await (
// await import("@react-md/release-script")
// ).getLatestTag();
// let tagName =
// mainPackage && /@\d/.test(latestTag)
// ? latestTag.replace(/.+(@\d)/, `${mainPackage}$1`)
// : latestTag;
//
// return tagName;
// },
});
Next, update package.json to include the release script:
"scripts": {
"prepare": "husky",
"typecheck": "tsc --noEmit",
"check-format": "prettier --check .",
"format": "prettier --write .",
"clean": "rm -rf dist",
"build": "tsc -p tsconfig.json",
+ "release": "tsx index.ts"
},
Finally, run the release script whenever a new release should go out:
pnpm release
Use the changesets api to enter the pre-release flow:
pnpm changeset enter pre
Once ready to do a real release:
pnpm changeset exit pre
FAQs
The release script I normally use for packages I publish to npm
We found that @mlaursen/release-script demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.

Security News
PyPI adds Trusted Publishing support for GitLab Self-Managed as adoption reaches 25% of uploads

Research
/Security News
A malicious Chrome extension posing as an Ethereum wallet steals seed phrases by encoding them into Sui transactions, enabling full wallet takeover.