Security News
38% of CISOs Fear They’re Not Moving Fast Enough on AI
CISOs are racing to adopt AI for cybersecurity, but hurdles in budgets and governance may leave some falling behind in the fight against cyber threats.
@publint/pack
Advanced tools
Zero-dependencies utilities for packing and unpacking npm packages. Supports:
NOTE: All pack*
APIs support passing opts.packageManager
to specify the package manager to use for packing, and opts.ignoreScripts
to skip running lifecycle scripts.
pack()
(dir: string, opts?: PackOptions): Promise<string>
Packs the given directory and returns the packed tarball path. Pass opts.destination
to change the output directory of the tarball.
import { pack } from '@publint/pack'
const tarballPath = await pack(process.cwd())
console.log(tarballPath)
// => '/Users/bluwy/project/project-1.0.0.tgz'
packAsList()
(dir: string, opts?: PackAsListOptions): Promise<string>
Packs the given directory and returns a list of relative file paths that were packed.
[!NOTE] Compared to
npm-packlist
, this API works at a higher level by invoking the package managerpack
command to retrieve the list of files packed. Whilenpm-packlist
is abstracted away fromnpm
to expose a more direct API, unfortunately not all package managers pack files the same way, e.g. the patterns in"files"
may be interpreted differently. Plus, sincenpm-packlist
v7, it requires@npmcli/arborist
to be used together, which is a much larger dependency to include altogether.This package provides an alternative API that works across package managers with a much smaller package size. However, as it executes commands in a child process, it's usually slightly slower (around 200-500ms minimum depending on package manager used and the project size).
import { packAsList } from '@publint/pack'
const files = await packAsList(process.cwd())
console.log(files)
// => ['src/index.js', 'package.json']
packAsJson()
(dir: string, opts?: PackAsJsonOptions): Promise<string>
Packs the given directory with the --json
flag and returns its stdout as JSON. You can run the <pm> pack --json
command manually to inspect the output shape.
[!NOTE] Does not work in pnpm <9.14.1 and bun as they don't support the
--json
flag.
import { packAsJson } from '@publint/pack'
const json = await packAsJson(process.cwd())
console.log(json)
// => [{ "id": "project@1.0.0", ... }]
unpack()
(tarball: ArrayBuffer | ReadableStream<Uint8Array>): Promise<UnpackResult>
Unpacks the given tarball buffer (gzip-decompress + untar). It accepts either an ArrayBuffer
or a ReadableStream
. In Node.js, ArrayBuffer
is faster, while in browsers, ReadableStream
is faster. For example when using fetch()
, you can decide between both types with its returned response: response.arrayBuffer()
or response.body
.
It returns an object with files
, which is the list of unpacked files, and rootDir
, which is the shared root directory among all files. (See JSDoc for examples)
import { unpack } from '@publint/pack'
const response = await fetch(
'https://registry.npmjs.org/mylib/-/mylib-1.0.0.tgz',
)
if (!response.body) throw new Error('Failed to fetch tarball')
const result = await unpack(response.body)
console.log(result)
// => { files: [...], rootDir: 'package' }
MIT
FAQs
Utilities for packing and unpacking npm packages
We found that @publint/pack demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
CISOs are racing to adopt AI for cybersecurity, but hurdles in budgets and governance may leave some falling behind in the fight against cyber threats.
Research
Security News
Socket researchers uncovered a backdoored typosquat of BoltDB in the Go ecosystem, exploiting Go Module Proxy caching to persist undetected for years.
Security News
Company News
Socket is joining TC54 to help develop standards for software supply chain security, contributing to the evolution of SBOMs, CycloneDX, and Package URL specifications.