Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@npmcli/node-gyp
Advanced tools
The @npmcli/node-gyp package is a Node.js native addon build tool that interfaces with Google's GYP (Generate Your Projects) to build native addon modules in Node.js. It is a replacement and standalone version of the node-gyp bundled with npm. It helps in compiling Node.js native addon modules using Node.js's libuv and V8, among other dependencies.
Building native addons
This code configures and builds a native addon using specific build settings. It sets the make command, architecture, and debug mode, then runs the build process.
const nodeGyp = require('@npmcli/node-gyp');
const config = {
make: 'make', // or 'gmake' on some systems
arch: process.arch,
debug: false
};
nodeGyp.configure(config, (err) => {
if (err) throw err;
nodeGyp.build((err) => {
if (err) throw err;
console.log('Build completed!');
});
});
Configuration of build environments
This code sample demonstrates how to clean up the build configuration for a project, which is useful when you want to ensure a fresh build environment.
const nodeGyp = require('@npmcli/node-gyp');
nodeGyp.clean((err) => {
if (err) throw err;
console.log('Configuration cleaned up.');
});
node-pre-gyp is a package that provides functionality similar to @npmcli/node-gyp but focuses on facilitating the publishing and installation of pre-built binaries. This is useful for avoiding the need to compile code on the installation machine, thus speeding up deployment and reducing setup complexity compared to @npmcli/node-gyp which compiles from source.
node-gyp-build is designed to simplify the process of building and using pre-compiled native addons. It automatically detects if a pre-built binary is available for a module and falls back to building from source if not. This package offers a simpler interface compared to @npmcli/node-gyp, which requires more manual configuration and build steps.
This is the module npm uses to decide whether a package should be built
using node-gyp
by default.
isNodeGypPackage(path)
Returns a Promise that resolves to true
or false
based on whether the
package at path
has a binding.gyp
file.
defaultGypInstallScript
A string with the default string that should be used as the install
script for node-gyp packages.
FAQs
Tools for dealing with node-gyp packages
We found that @npmcli/node-gyp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.