
Security News
Another Round of TEA Protocol Spam Floods npm, But It’s Not a Worm
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.
@no-npm/nonpm
Advanced tools
The not only NPM project helps you to run micro frontends directly from a npm package.
The not only NPM project helps you to run micro frontends directly from a npm package. It adds the ability to serve the package content. Any package on npm only needs the serve object in the package.json:
{
"serve": "public/remoteEntry.js"
}
If the noNPM.io URL is now used as an import, the public/remoteEntry.js is served:
import { remoteHello } from 'https://nonpm.io/@no-npm/example';
console.log(remoteHello); // run in a browser it will print "hello from remote"
While NPM is great, with upcoming micro frontends trend, NPM does not serve the necessary of remote modules. While one could argue, that anyone could serve simply static files, the ability of NPM to manage versions, tagging and disallow reusing versions is exactly what is needed to run a micro frontend architecture. The following examples all resolve different versions of the @no-npm/example package:
import { remoteHello } from 'https://nonpm.io/@no-npm/example@1.0.1';
import { remoteHello } from 'https://nonpm.io/@no-npm/example@^1.0.1';
import { remoteHello } from 'https://nonpm.io/@no-npm/example@~1.0.1';
import { remoteHello } from 'https://nonpm.io/@no-npm/example@latest';
import { remoteHello } from 'https://nonpm.io/@no-npm/example@beta';
We recommend a self hosting of noNPM to ensure your own SLAs. You can even point it to a private registry (e.g. verdaccio) to build up your own+npm hosted micro frontend architecture.
npx @no-npm/cli --registry http://localhost:4111
You can always browse your local supported packages by opening the web interface locally http://localhost:3000. See all options of the @no-npm/cli by running --help.
The serve entry of your PR can be extended to add additional information about the micro frontend:
{
"serve": {
"url": "public/remoteEntry.js",
"demo": "public/demo/index.html"
}
}
FAQs
The not only NPM project helps you to run micro frontends directly from a npm package.
We found that @no-npm/nonpm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.

Security News
PyPI adds Trusted Publishing support for GitLab Self-Managed as adoption reaches 25% of uploads

Research
/Security News
A malicious Chrome extension posing as an Ethereum wallet steals seed phrases by encoding them into Sui transactions, enabling full wallet takeover.