
Product
Introducing Supply Chain Attack Campaigns Tracking in the Socket Dashboard
Campaign-level threat intelligence in Socket now shows when active supply chain attacks affect your repositories and packages.
bare-build
Advanced tools
Application builder for Bare that allows developers to package their JavaScript code as either native application bundles or standalone executables for both desktop and mobile.
npm i [-g] bare-build
const build = require('bare-build')
for await (const resource of build('/path/to/app.js', {
base: '/path/to/',
target: ['darwin-arm64', 'darwin-x64'],
icon: 'icon.icns',
identifier: 'com.example.App'
})) {
console.log(resource)
}
bare-build \
--target darwin-arm64 --target darwin-x64 \
--icon icon.icns \
--identifier com.example.App \
app.js
| Platform | Unpackaged | --package | --standalone |
|---|---|---|---|
| Linux | .AppDir, Snap compatible | .AppImage | ELF executable with self-extracting .so libraries |
| Android | .apk | .aab | ELF executable with self-extracting .so libraries |
| macOS | .app | .pkg | Mach-O executable with self-extracting .framework libraries |
| iOS | .app | .pkg | Mach-O executable with self-extracting .framework libraries |
| Windows | Plain directory | .msix | PE executable with self-extracting .dll libraries |
for await (const resource of build(entry[, preflight][, options]))Options include:
options = {
name: pkg.name,
version: pkg.version,
author: pkg.author,
description: pkg.description,
icon,
identifier,
manifest,
resources,
base: '.',
target: [],
out: '.',
runtime,
standalone: false,
package: false,
sign: false,
// Apple signing options
identity: 'Apple Development',
applicationIdentity: identity,
installerIdentity: identity,
keychain,
entitlements,
hardenedRuntime: false,
// Windows signing options
subject,
subjectName,
thumbprint,
// Linux signing options
key,
// Android signing options
keystore,
keystoreKey,
keystorePassword
}
bare-build [flags] <entry>Flags include:
--version|-v Print the current version
--name|-n <name> The application name
--author <name> The name of the application author
--description <text> The description of the application
--icon|-i <path> The application icon
--identifier <id> The unique application identifier
--manifest <path> The platform specific application manifest
--resources <path> The platform specific application resources
--base <path> The base path of the application (default: .)
--target|-t <host> The host to target
--out|-o <dir> The output directory
--runtime <specifier> The runtime to use
--standalone Build a standalone executable
--package Package the application for distribution
--sign Sign the application
--identity <id> The macOS signing identity
--application-identity <id> The macOS application signing identity
--installer-identity <id> The macOS installer signing identity
--keychain <name> The macOS signing keychain
--entitlements <path> The macOS signing entitlements
--hardened-runtime Enable the macOS hardened runtime
--subject <id> The Windows signing subject
--subject-name <name> The Windows signing subject friendly name
--thumbprint <sha1> The Windows signing subject thumbprint
--key <hash> The GPG signing key
--keystore <path> The Java-based keystore file
--keystore-key <name> The name of the certificate to use from the keystore
--keystore-password <password> The password to the keystore file
--help|-h Show help
Apache-2.0
FAQs
Application builder for Bare
The npm package bare-build receives a total of 394 weekly downloads. As such, bare-build popularity was classified as not popular.
We found that bare-build demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Product
Campaign-level threat intelligence in Socket now shows when active supply chain attacks affect your repositories and packages.

Research
Malicious PyPI package sympy-dev targets SymPy users, a Python symbolic math library with 85 million monthly downloads.

Security News
Node.js 25.4.0 makes require(esm) stable, formalizing CommonJS and ESM compatibility across supported Node versions.