
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
git-subpath
Advanced tools
Publish subpath of a repository to a prescribed version. Useful for installing node modules from a monorepo on github.
This package helps in the installation of monorepo modules in subpaths from a git repository with npm, which is currently not supported.
This is done by wrapping the contents of a targetted subpath, and pushing with a tag to the same git repository, where it is now the root path and where the npm installation path can be referenced from. For a private repository, these tags remain private for access only within your organisation.
To install:
npm install --save-dev git-subpath
To use, ensure that you have a subpath in your monorepo repository that you want to tag for use in your other projects. Prepare the module name and the tag as well. The full command to create the tag should be like the following:
git-subpath -p packages/Helper -m Helper -t v0.0.1
p flag represents the path for the targetted installationm flag represents the module name that will be used as part of the tag namespacet flag represents the version number or id variant that will be used as part of the tag namespaceUpon invoking the above command successfully, the log should reveal the installation instructions at the end
=========================
Example install paths (switch out protocol as long as the remote + tag works for you) -
HTTPS install: "npm install --save git+https://git@github.com:user/repo.git#v0.0.1-Helper"
SSH install: "npm install --save git+ssh://git@github.com:user/repo.git#v0.0.1-Helper"
Invoke the following after the module has been installed
git-subpath --help
Instructions such as the following should appear
Usage: git-subpath [options]
Options:
-V, --version output the version number
-p, --path <value> Target path to submit
-m, --module <value> Module name
-t, --tag <value> Tag version of module
-h, --help output usage information
FAQs
Publish subpath of a repository to a prescribed version. Useful for installing node modules from a monorepo on github.
We found that git-subpath demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.