
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
@space307/publish-wizard
Advanced tools
The easiest way to publish packages for projects using Lerna and NPM
The easiest way to publish packages for projects using Lerna and NPM.
When publishing packages, it is necessary to follow the correct sequence of updates.
For example, we have three packages: A, B, C. B depends on A. C depends on B.
If we want to update A, we need to update B and C (A -> B -> C).
We can specify versions of dependencies flexibly, but this does not help in the case of publishing an unstable version of a package (with next postfix, for example). Adding more packages will only make the problem of queuing worse.
Publish Wizard helps you not to think about the problem of queuing, allowing you to focus on what's important.
https://user-images.githubusercontent.com/8722478/125296270-c9e28b00-e32e-11eb-9938-adcd705e1912.mp4
Publish Wizard will repeat the cycle of questions for all the packages that need to be updated.
It will result in a queue of packages that have been published.
Published packages:
1. my-awesome-package@1.0.0-next.3
2. kitty@3.0.2-alpha.0
3. mushroom@7.1.3-nightly.4
Soon...
Publish Wizard will display the queue of packages that need to be updated.
Bump packages in order:
1. my-awesome-package
2. kitty
3. mushroom
5. sandbox
{
"name": "my-awesome-package",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1",
"prepublishOnly": "<do-smth-before-publish>"
}
}
@space307/publish-wizard:npm install --save-dev @space307/publish-wizard
# or
yarn add @space307/publish-wizard --dev
publish-wizard script to your root package.json: {
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1",
+ "publish-wizard": "publish-wizard"
}
}
npm run publish-wizard
# or
yarn run publish-wizard
You can specify custom postfixes and publish command through the config.
Publish Wizard supports three ways to define config.
publish-wizard section in package.json:"publish-wizard": {
"postfixes": ["my", "awesome", "postfixes"],
"publishCommand": "run my-awesome-command"
}
.publish-wizard.json config file:{
"postfixes": ["my", "awesome", "postfixes"],
"publishCommand": "run my-awesome-command"
}
Options description:
postfixes: list of postfixes that will be added to the standard list.
publishCommand: the command that will be called to publish. publish by default.
All options are optional.
FAQs
The easiest way to publish packages for projects using Lerna and NPM
We found that @space307/publish-wizard demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.