Security News
GitHub Removes Malicious Pull Requests Targeting Open Source Repositories
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.
basetag lets you use local modules relative to your Node.js project base path
basetag
creates a $
symlink in your local node_modules
so that you can:
π Turn this:
const balls = require('../../../../baseball/balls'); // β
π€― Into this:
const balls = require('$/baseball/balls'); // β
Install as a dev dependency:
npm install --save-dev basetag
Create a $
symlink in your local node_modules
by running:
npx basetag link --hook
Upgrade existing require
s and import
s to the basetag way:
# require('../../baseball') => require('$/baseball')
npx basetag rebase
β οΈ Unfortunately, npm does not like basetag very much
npm will remove the
$
on everynpm install <package>
To fix this issue there are some solutions:
Use the postinstall
script to run basetag after every npm install
package.json
"scripts": {
"postinstall": "npx basetag link"
}
Use the --hook
flag (which sets up an npm hook that runs basetag after every npm install <package>
You only have to do this once (unless you delete your
node_modules
folder). But, you can also use this in connection with Fix #1.
npx basetag link --hook
basetag has a few commands that can be run via npx basetag <command>
link [--absolute] [--hook]
β creates a relative $
symlink
--absolute
creates an absolute symlink rather than relative--hook
sets up basetag to run after every npm install ...
rebase
- upgrades require
s and import
s to use the package-relative $/
debase
- downgrades require
s and import
s to use file-relative ../
sWhat does basetag
solve?
In Node.js applications we sometimes want to import local modules that are in different far away subdirectories.
This can lead to very messy looking require
statements.
Using basetag you can import modules with $/
as the project base path.
If you're not convinced, check out the example below...
π€― The modern basetag way:
const balls = require('$/baseball/balls'); // β
π The traditional (often messy) way:
const balls = require('../../../../baseball/balls'); // β
basetag
?It's really all described above and there's not much to it.
Look at the code in test/example/
for an executable example.
A larger project can have many nested subfolders as shown in the directory structure below.
Of course a real project would have more files in those subdirectories but for simplicity we'll leave those out.
Using basetag you can reference modules from the base example/
path, rather than using relative directories (i.e. ../../..
).
example/
βββ its/
β βββ baseballs/
β βββ all/
β βββ the/
β βββ way/
β βββ down.js
βββ somewhere/
β βββ deep/
β βββ and/
β βββ random.js
βββ index.js
basetag
work?It's rather simple.
By running basetag, a symlink is created that points from node_modules/$
to your project base path.
Everytime you use a require
with $/β¦
Node.js will look inside the $
package (i.e. our new symlink).
The lookup is routed natively to your project files.
To Node.js, both methods of requiring look the same, because the files are literally the same files. Both methods can be used in the same project and Node.js will cache imports correctly.
basetag
supports macOS, Linux, and Windows as of version 1.1.0
.
FAQs
A better way to import NodeJS modules
We found that basetag demonstrated a not healthy version release cadence and project activity because the last version was released a year ago.Β It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.
Security News
RubyGems.org has added a new "maintainer" role that allows for publishing new versions of gems. This new permission type is aimed at improving security for gem owners and the service overall.
Security News
Node.js will be enforcing stricter semver-major PR policies a month before major releases to enhance stability and ensure reliable release candidates.