
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
billi-framework
Advanced tools
This guide explains how to set up the Billi framework for publishing to npm.
You'll need two separate npm packages:
billi-framework/
├── packages/
│ ├── create-billi-app/ # CLI installer package
│ │ ├── index.js
│ │ ├── package.json
│ │ └── README.md
│ └── billi/ # Core framework package
│ ├── bin/
│ │ └── billi.js
│ ├── lib/
│ │ └── server.js
│ ├── package.json
│ └── README.md
└── README.md
{
"name": "create-billi-app",
"version": "1.0.0",
"description": "Create Billi apps with one command",
"main": "index.js",
"bin": {
"create-billi-app": "./index.js"
},
"keywords": [
"billi",
"react",
"framework",
"ssr",
"scaffolding",
"cli"
],
"author": "Your Name",
"license": "MIT",
"repository": {
"type": "git",
"url": "https://github.com/yourusername/create-billi-app"
},
"engines": {
"node": ">=16.0.0"
},
"dependencies": {},
"files": [
"index.js",
"README.md"
]
}
cd packages/create-billi-app
npm login
npm publish
Users will then run:
npx create-billi-app@latest my-app
{
"name": "billi",
"version": "1.0.0",
"description": "A modern React framework with SSR, routing, and more",
"main": "lib/server.js",
"bin": {
"billi": "./bin/billi.js"
},
"keywords": [
"billi",
"react",
"framework",
"ssr",
"server-side-rendering",
"routing",
"api-routes"
],
"author": "Your Name",
"license": "MIT",
"repository": {
"type": "git",
"url": "https://github.com/yourusername/billi"
},
"engines": {
"node": ">=16.0.0"
},
"peerDependencies": {
"react": "^18.0.0",
"react-dom": "^18.0.0"
},
"dependencies": {
"chokidar": "^3.5.3"
},
"devDependencies": {
"react": "^18.3.1",
"react-dom": "^18.3.1"
},
"files": [
"bin/",
"lib/",
"README.md"
]
}
bin/billi.js:
#!/usr/bin/env nodechmod +x bin/billi.jslib/server.js:
cd packages/billi
chmod +x bin/billi.js
npm login
npm publish
Before publishing, test locally:
# Link the core framework
cd packages/billi
npm link
# Link the CLI
cd ../create-billi-app
npm link
# Test in a new project
mkdir test-app
cd test-app
npx ../packages/create-billi-app test-project
cd test-project
npm link billi
npm run dev
cd packages/billi
npm pack
# This creates billi-1.0.0.tgz
cd packages/create-billi-app
npm pack
# This creates create-billi-app-1.0.0.tgz
# Install in test project
npm install /path/to/billi-1.0.0.tgz
Use semantic versioning:
Update versions in both packages:
# Update version
npm version patch # or minor, or major
# Publish
npm publish
cd packages/billi
npm install chokidar # File watching
npm install --save-dev react react-dom
Before publishing:
npm linknpx create-billi-app@latest testfiles in package.json)Create .npmignore in each package:
# Development files
node_modules/
.git/
.gitignore
*.log
# Test files
test/
tests/
__tests__/
*.test.js
# Documentation
docs/
examples/
# Build files
.DS_Store
*.swp
*.swo
billi-framework/packagesname: Publish to NPM
on:
release:
types: [created]
jobs:
publish:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: actions/setup-node@v3
with:
node-version: '18'
registry-url: 'https://registry.npmjs.org'
- name: Install dependencies
run: |
cd packages/billi && npm install
cd ../create-billi-app && npm install
- name: Publish billi
run: cd packages/billi && npm publish
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
- name: Publish create-billi-app
run: cd packages/create-billi-app && npm publish
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
# 1. Initialize project
mkdir billi-framework && cd billi-framework
npm init -y
# 2. Create package structure
mkdir -p packages/billi/{bin,lib}
mkdir -p packages/create-billi-app
# 3. Copy files
# - Copy server.js to packages/billi/lib/
# - Copy billi.js to packages/billi/bin/
# - Copy index.js (CLI) to packages/create-billi-app/
# 4. Make executable
chmod +x packages/billi/bin/billi.js
chmod +x packages/create-billi-app/index.js
# 5. Test locally
cd packages/billi && npm link
cd ../create-billi-app && npm link
# 6. Create test app
npx create-billi-app test-app
cd test-app
npm link billi
npm run dev
# 7. Publish (when ready)
cd packages/billi && npm publish
cd ../create-billi-app && npm publish
After publishing:
npx create-billi-app@latest my-appchmod +x bin/billi.js#!/usr/bin/env nodenpm pack to inspect package contentsFor issues or questions:
FAQs
A modern React framework with SSR, routing, and more
We found that billi-framework demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.