
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
an opinionated build toolset that is dead-simple so you can focus on writing code
an opinionated hack-space for building things fast without spending a bunch of time setting things up
Installing germs as a dependency:
yarn install germs nps nps-utils -D or npm i germs nps nps-utils -D
Installing nps - a delightful build tool (optional but useful):
yarn install nps global or npm i nps -g
Create a new file package-scripts.js, and place the following in it.
const germs = requⅰre("germs")
const {name} = requⅰre("package.json")
module.exports = germs(name)
Here is an example from germs own specific package-script.js file.
germs relies on the following modules for a good build experience:
nps for build tasksbabel for per-file conversionrollup for bundled conversionjest for testingexeca for testing CLI implementationsdont-break for downstream testingeslint for static analysis rules (static analysis rules!)documentation for automatic jsdoc > documentation generationmadge for dependencies and graphsdepcheck for (sometimes-unreliable) dependency checkingupdtr for automatic package updateshusky for some commit conventions (use --no-verify to skip)nps dependencies.check - check dependenciesnps dependencies.graph - generate a visual dependency graphnps dependencies.graphjson - generate a visual dependency graph in jsonnps dependencies.graphdot - generate a visual dependency graph in dotnps readme - regenerate the readmenps lint - lint both the js and the jsdocnps lint.src - lint js filesnps lint.jsdoc - lint jsdoc in filesnps test - run all tests with coveragenps test.unit - run unit testsnps docs - auto regen the docsnps bundle - run the main bundle tasknps build - convert files individuallynps care - run all the thingsnps precommit - nps careContributions welcome!
germs is opinionated, but your suggestions / contributions are welcome.
Parameters
custom Object configuration
custom.name string name of projectcustom.alias Object aliases to use in the projectcustom.external Array an array of external dependenciescustom.alterPlugins Function an optional function which gets the plugins as inputcustom.customize Function an optional function which allows you to alter all outputExamples
const pkg = require(`../package.json`)
const {rollup} = require(`../germs`)
const external = (
pkg && pkg.dependencies ? Object.keys(pkg.dependencies) : []
)
module.exports = rollup({
name: pkg.name,
alias: {
[`@tools`]: `./tools`
},
external
})
Returns Object config file for rollup
Parameters
custom Object configuration
custom.name string name of projectcustom.alias Object aliases to use in the projectcustom.external Array an array of external dependenciescustom.alterPlugins Function an optional function which gets the plugins as inputcustom.customize Function an optional function which allows you to alter all outputcustom.input string an input filecustom.output Object an output object
Examples
const pkg = require(`../package.json`)
const {bundle} = require(`../germs`)
const external = (
pkg && pkg.dependencies ?
Object.keys(pkg.dependencies) :
[]
)
module.exports = bundle({
name: pkg.name,
alias: {
[`@tools`]: `./tools`
},
external,
input: `src/index.js`,
output: {
file: `./${pkg.name}.js`,
format: `cjs`
}
})
Returns Object config file for rollup
FAQs
an opinionated build toolset that is dead-simple so you can focus on writing code
We found that germs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.