
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
Go2npm is a tool that helps you integrate your binary packages into npm;when c、c++、rust or go programs are packaged and compiled, they are usually cross-compiled, we should use different binary packages for different operating systems,go2npm will automatically match the corresponding binary package to the user's operating system,Download it to npm local or global dependencies, supports downloading binaries from public, private repositories.
If, for example, you already have successfully released some binary and have them managed in github.
And your binary names should follow this specification:
{{name}}_{{version}}_{{platform}}_{{arch}}.tar.gz
If you use goreleaser package your program, it will automatically write each parameter.
Create an empty folder and initialize it with the npm init command to make it an npm package
npm init -y
Change the data in package.json to information about the binary tool's info.
Add a property to package.json called go2npm:
{
"go2npm": {
"username": "[value]",
"repoName": "[value]",
"tagName": "[value]",
"version": "[value]",
"githubToken": "[value]",
"name": "[value]"
}
}
| Property | Is required | Description |
|---|---|---|
| username | true | Github account username |
| repoName | true | Your binary repository's name |
| tagName | true | Which tag version do you want to download from the golong’s repository |
| version | true | Your binary release version which you want to download |
| githubToken | false | If your binary's repository is private, need this value |
| name | true | Your binary file name, the command use at npm |
Add two commands to the script property in package.json, and add go2npm to the devDependencies:
{
"script": {
"postinstall": "go2npm install",
"preuninstall": "go2npm uninstall"
},
"devDependencies": {
"go2npm": "^1.2.11"
}
}
Publish your npm app (includes the binary repository info), you can publish to the official platform or to your own private npm repository
npm publish
Use npm to install and have fun with your binary application toolkit.
npm install [your npm app name] [-g]
Use yarn
yarn add [your npm app name] [-g]
If you installed in local npm dependency, execute command:
npx [binary-name] [options]
If you installed in global npm dependency, execute command:
[binary-name] [options]
MIT
FAQs
Distribute and install Go binaries via NPM
We found that go2npm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.