Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
@terminal-packages/fe-theme
Advanced tools
![Test Action Status](https://github.com/Terminal-Systems/fe-utils/workflows/Tests/badge.svg) ![Publish Action Status](https://github.com/Terminal-Systems/fe-utils/workflows/Publish/badge.svg?branch=master)
Base Typescript boilerplate to build FE packages on top of it
build
: build src
directorybuild:cjs
: build src
directory using cjs
modulesbuild:esm
: build src
directory using esm
modulesstorybook
: run storybook on port 9001
clean
: delete core
folderlint
: run eslint
on src
folderlint:fix
: run eslint in fixing mode on src
foldertest
: run testsNote that our build
directory is called core
, that way you can publish the package and using it package-name/core/SomeComponent
like material-ui
git clone https://github.com/Terminal-Systems/fe-base-pkg.git <package-name>
package.json
:
name
: package name (use @org-name/pkg-name for orgs)version
: 1.0.0author
: list of authorsrepository.url
: git+https://github.com/<username>/<package-name>.git
bugs.url
: https://github.com/<username>/<package-name>/issues
homepage
: https://github.com/<username>/<package-name>#readme
git remote rm origin
git remote add origin <your-new-git-remote-url>
As a result of changed the remote url for the library you will not be able to fetch the last updates using git pull origin
, instead, you should use:
git remote add fe-base-pkg https://github.com/Terminal-Systems/fe-base-pkg.git
git checkout -b <some-temp-branch-name>/upgrade
git fetch fe-base-pkg
git merge fe-base-pkg/master
If you want to create a non React
based library, you should remove some dependencies that are not required. To do that, please remove the following libraries from package.json
devDependencies
and peerDependencies
:
@material-ui/core
prop-types
react
react-dom
@types/prop-types
@types/react
@types/react-dom
If you need to use a package that should be provided by your host app, please adding it as a peerDependencie
to avoid library duplications on node_modules
.
Important Note: peerDependencies
are not installed by npm install
or yarn install
. So in order to install peerDependencies
on dev enviroment you can add your required package as a peerDependencies
and devDependencies
. Otherwise, you can use a package like install-peers-cli
Our library workflow is pretty straightforward: use develop
branch to add any new feature and master
to publish on npmjs.com
This boilerplate is pre-configured with jest. You can run your tets with the command: npm test
. If you need to use some of the enzyme
render methods, please consider use the test-utils
provided by @material-ui/core/test-utils
:
createMount
createShallow
createRender
Before commit any change, husky is going to run eslint in fixing mode, run tests and try to build the project to avoid pushing commits that break something
FAQs
![Test Action Status](https://github.com/Terminal-Systems/fe-utils/workflows/Tests/badge.svg) ![Publish Action Status](https://github.com/Terminal-Systems/fe-utils/workflows/Publish/badge.svg?branch=master)
The npm package @terminal-packages/fe-theme receives a total of 14 weekly downloads. As such, @terminal-packages/fe-theme popularity was classified as not popular.
We found that @terminal-packages/fe-theme demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.