
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Hi, I'm Douglas.
I fetch npm packages and install them as ready to roll projects.
When I fetch an npm package, I empty it's contents to your current directory - along with all dependencies.
I'm perfect for seed projects, demos, and simple project scaffolding.
Install me globally
npm i -g douglas
Now I'm on your command line.
Or if you just need me semi-frequently, you can just skip the global install and use via npx.
Let's find an npm package.
e.g...
If globally installed:
douglas get doug-test
Or if not installed globally...
npx douglas get doug-test
Douglas goes off an installs doug-test + dependencies, moves the contents to the current directory, and then removes doug-test from node_modules.
To publish a project, use
douglas publish
This clones your package.json and names it _package.json.
What's with the _package.json I hear you ask...
When douglas fetches a package - it replaces the package.json (that has been altered through the publishing process) with _package.json (which doesn't undergo any changes).
Fun fact: You can still
douglas getany npm package, even if it doesn't have a _package.json, but you'll notice a far more verbose package.json due to all the the things that the npm publish process adds in.
Remember to bump your version in package.json before publishing.
Also - make sure you include the keyword douglas to your package.json or even prepend your npm package with doug- or douglas- e.g. doug-test. Or douglas-test.
This just makes douglas packages easier to find.
When you're ready...
douglas publish
FAQs
Douglas fetches npm packages and installs them as ready-to-roll projects
We found that douglas demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.