
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
A blazing-fast, standalone Rust-powered tool for reformatting specifiers and verifying package.json files with zero setup.
Blazing-fast Automation Module (BAM) for your JavaScript/TypeScript projects. This package delivers Zoboz's powerful safety checks and shimming features without forcing you into a specific orchestration flow.
@zoboz/bam is the lightweight, high-performance core of Zoboz's functionality, designed for developers who want maximum flexibility. It provides essential features like:
package.json stays clean and consistent.All of this without dictating how you should orchestrate your workflows.
| Feature | @zoboz/bam | @zoboz/core |
|---|---|---|
| Orchestration | Manual, you control the flow | Automated, handles everything out of the box |
| Performance | Optimized, minimal overhead | Slightly heavier due to orchestration layer |
| Flexibility | Total, use what you need | Less flexible, but convenient |
| Dependencies | Lean, no extra bloat | Includes all orchestration dependencies |
| Ideal for | Advanced users, custom workflows | Quick setups, full automation |
If you're looking for a more "plug-and-play" experience where everything is handled for you, check out @zoboz/core.
The following table applies to the development phase of your package. Consumers of your package can rely on even older versions of Node.js if you do not use features unavailable in older versions. Essentially, your package determines Node.js compatibility for its users.
| Operating System | arm64 | x64 |
|---|---|---|
| MacOS | ✅ Fully Native | ✅ Fully Native |
| Linux | ✅ Fully Native | ✅ Fully Native |
| Windows | ✅ Fully Native | ✅ Fully Native |
npm install -g @zoboz/bam
or with Yarn:
yarn global add @zoboz/bam
Reformat import/export specifiers in your project files.
zoboz-bam reformat-specifiers \
--absolute-package-dir /path/to/your/package \
--absolute-source-dir /path/to/your/src \
--absolute-output-dir /path/to/output \
--output-format esm
Notice: the file contents for both absolute-source-dir and absolute-output-dir should already exist. This tool is going to overwrite the needed adjustments in the absolute-output-dir. Think of it more like how a linter with --fix works, but on the generated dist code rather than the source code.
Options:
--absolute-package-dir: Absolute path to your package.json directory.--absolute-source-dir: Absolute path to the actual source code directory.--absolute-output-dir: Absolute path to the already transpiled output, to get reformatted.--output-format: Specify the output format the output is following (dts, esm, or cjs).Verify and optionally fix issues in your package.json file.
zoboz-bam verify-package-json \
--absolute-package-dir /path/to/your/package \
--can-update-package-json
Options:
--absolute-package-dir: Absolute path to your package.json directory.--can-update-package-json: If included, the tool will automatically fix detected issues.If you want automation without sacrificing control, @zoboz/bam is your go-to.
MIT License.
For full automation, orchestration, and more out-of-the-box features, check out @zoboz/core.
Happy hacking! 🚀
FAQs
A blazing-fast, standalone Rust-powered tool for reformatting specifiers and verifying package.json files with zero setup.
We found that @zoboz/bam demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.