Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@seroh/template-npm-package
Advanced tools
This is a template repository which you can use to quickly bootstrap your own NPM package.
The fastest way is to use GitHub CLI:
# Create a new repository using a template and clone it
gh repo create new-repo-name --template serohman/npm-typescript-module
gh repo clone new-repo-name
Or refer to the official guide for creating repositories from a template.
You need to generate an NPM access token and save it as a GitHub Action Secret, under the key name NPM_TOKEN
Use GitHub CLI
# A prompt for entering the npm token will appear
gh secret set NPM_TOKEN
Or set the secret via the web UI by navigating to your repository's GitHub page, and then: Settings > Secrets and variables > Actions > New repository secret
.
npm install
Open package.json
and fill out all the relevant fields:
name
author
description
tags
license
publishConfig.access
(Set to private
to make your package private)To publish your package, switch to the release
branch, then create and push a semantic commit with the changes you've made to package.json
. Once the changes are pushed, GitHub Actions will automatically publish your package.
git checkout -b "release"
git stage .
git commit -m "feat: Setup package"
git push --set-upstream origin release
And voilà!🎉 The moment new changes hit the release branch, GitHub Actions will pick them up and publish a new release on NPM.
These commands are used during the development process to build, test, lint, and format the code.
start
: Runs the build
script.build
: Compiles the TypeScript code and watches for changes.test
: Runs Jest in watch mode.lint
: Runs ESLint on the ./src
directory.format
: Formats the code in the ./src
directory using Prettier.These commands are executed before a commit is made to ensure code quality and consistency. They check for issues in the staged files, attempt to fix them automatically (using the --fix flag), and display an error if the issues cannot be fixed. If any problems remain unresolved, the commit is prevented.
precommit
: Runs lint-staged to check staged files.precommit:format
: Formats staged files using Prettier.precommit:lint
: Fixes linting issues in staged files using ESLint.precommit:test
: Runs Jest on related tests for staged files.precommit:typecheck
: Type checks the code without emitting output.These commands are executed by GitHub Actions on the release
branch. Each time a change is pushed to the release
branch, these actions are triggered. If any action fails, the release process is halted until the issues are resolved.
ci:lint
: Runs ESLint with a CI-specific configuration.ci:test
: Runs Jest with a CI-specific configuration.ci:build
: Builds the TypeScript project.ci:format
: Checks code formatting using Prettier.FAQs
Template for authoring an NPM package
We found that @seroh/template-npm-package demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.