
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
documentation
Advanced tools
A documentation generation system that's beautiful by default, flexible across formats and styles, and powerful enough to support JSDoc's advanced syntax.
ES5 and ES6 support of JavaScript, with support for other transpilers a possibility
Using espree, we have support for a wide range of ES6 features.
Support for C++
You can use the --polyglot mode of documentationjs to document native node.js
modules in JSDoc within the C++ code that implements the feature.
Support for following dependency trees
Using module-deps, documentation can
crawl require() graphs - pointing it to your app's main file will find all
referenced files and include all of their documentation.
GitHub Integration
The --github option automatically permalinks documentation to the exact
sections of code it refers to in a GitHub repository.
Gulp integration
The gulp-documentation project
lets you run documentation as a Gulp build task.
Getting_Started: start here
Usage: how to use documentation.js
Recipes: tricks for writing effective JSDoc docs
Node API: documentation.js's self-generated documentation
Theming HTML: tips for theming documentation output in HTML
See also: a list of projects similar to documentation.js
Globally install documentation using the npm package manager:
$ npm install -g documentation
This installs a command called documentation in your path, that you can
point at JSDoc-annotated source code to generate
human-readable documentation. First run documentation with the -h
option for help:
$ documentation -h
Usage: documentation <command> [options]
Options:
-f, --format output format, of [json, md, html] [default: "json"]
--lint check output for common style and uniformity mistakes
-t, --theme specify a theme: this must be a valid theme module
-p, --private generate documentation tagged as private
--name project name. by default, inferred from package.json
--version project version. by default, inferred from package.json
--shallow shallow mode turns off dependency resolution, only processing
the specified files (or the main script specified in
package.json) [default: false]
--polyglot polyglot mode turns off dependency resolution and enables
multi-language support. use this to document c++
-g, --github infer links to github in documentation
-o, --output output location. omit for stdout, otherwise is a filename for
single-file outputs and a directory name for multi-file
outputs like html [default: "stdout"]
-c, --config configuration file. an array defining explicit sort order
-h, --help Show help
Examples:
documentation foo.js parse documentation in a given file
We have plenty of issues that we'd love help with.
JSDoc support, including typedefs.documentation is an OPEN Open Source Project. This means that:
Individuals making significant and valuable contributions are given commit-access to the project to contribute as they see fit. This project is more like an open wiki than a standard guarded open source project.
FAQs
a documentation generator
The npm package documentation receives a total of 30,972 weekly downloads. As such, documentation popularity was classified as popular.
We found that documentation demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.