
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
goreleaser-npm-publisher
Advanced tools
Build and publish npm packages based on goreleaser output folder
Automated tool for building and publishing NPM packages from Go binaries.
First, create a release of your package using goreleaser.
goreleaser build --clean
Then, run goreleaser-npm-publisher in the same directory. Make sure you're logged into the registry.
npx -y goreleaser-npm-publisher publish --clean
Alternatively, add the --token parameter to use your NPM_AUTH_TOKEN.
npx -y goreleaser-npm-publisher publish --clean --token npm_********
That’s it!
You can use goreleaser-npm-publisher as a standard npm package.
import { publish } from 'goreleaser-npm-publisher';
publish({ token: process.env.NPM_TOKEN })
.then(console.log)
.catch(console.error);
You can use goreleaser-npm-publisher as a GitHub Action.
- name: Publish to npm
uses: evg4b/goreleaser-npm-publisher-action@v1.0.0
with:
prefix: '@evg4b'
token: ${{ secrets.NPM_AUTH_TOKEN }}
For more details, see the GitHub Action documentation.
goreleaser-npm-publisher provides the following CLI commands:
Displays a list of packages that can be built in the current project using the specified options.
| Option | type | Description |
|---|---|---|
| project | string | Specifies the path to the root of the Go package. |
| builder | string | The name of the builder whose output will be used for building the packages. |
| prefix | string | NPM package scope prefix. |
| description | string | NPM package description. |
| verbose | boolean | Print verbose output. |
Builds all packages that can be built in the current project using the specified parameters.
The built packages can be found in the dist/npm folder.
| Option | Type | Description |
|---|---|---|
| project | string | Specifies the path to the root of the Go package. |
| builder | string | The name of the builder whose output will be used for building the packages. |
| clear | boolean | Clean the dist/npm folder before the build. |
| prefix | string | NPM package scope prefix. |
| description | string | NPM package description. |
| files | string[] | Files that should be included in the NPM package (e.g., README.md, LICENSE by default). |
| keywords | string[] | NPM package keywords. |
| verbose | boolean | Print verbose output. |
Builds and publishes to the registry all packages that can be built in the current project using the specified
parameters.
| Option | Type | Description |
|---|---|---|
| project | string | Specifies the path to the root of the Go package. |
| builder | string | The name of the builder whose output will be used for building the packages. |
| clear | boolean | Clean the dist/npm folder before the build. |
| prefix | string | NPM package scope prefix. |
| description | string | NPM package description. |
| files | string[] | Files that should be included in the NPM package (e.g., README.md, LICENSE by default). |
| keywords | string[] | NPM package keywords. |
| token | string | The NPM authentication token. |
| verbose | boolean | Print verbose output. |
The output will include a main package and platform packages. The main package will contain the executable script that detects the platform and architecture, running the corresponding platform package. The platform packages will include the Go binary for the specific platform and architecture.
For example, for the package go-package with version 0.0.17, and with Goreleaser building for linux, windows,
and darwin along with ia32, x64, and arm64 architectures:
Main package:
go-package@0.0.17
os: linux, win32, darwin
cpu: ia32, x64, arm64
Platform packages:
go-package_linux_386@0.0.17
os: linux
cpu: ia32
bin: /Users/<user>/go-package/dist/npm/dist-go-package-linux-386-go-package
go-package_windows_386@0.0.17
os: win32
cpu: ia32
bin: /Users/<user>/go-package/dist/npm/dist-go-package-windows-386-go-package-exe
go-package_linux_amd64@0.0.17
os: linux
cpu: x64
bin: /Users/<user>/go-package/dist/npm/dist-go-package-linux-amd-64-v-1-go-package
go-package_linux_arm64@0.0.17
os: linux
cpu: arm64
bin: /Users/<user>/go-package/dist/npm/dist-go-package-linux-arm-64-go-package
go-package_windows_arm64@0.0.17
os: win32
cpu: arm64
bin: /Users/<user>/go-package/dist/npm/dist-go-package-windows-arm-64-go-package-exe
go-package_windows_amd64@0.0.17
os: win32
cpu: x64
bin: /Users/<user>/go-package/dist/npm/dist-go-package-windows-amd-64-v-1-go-package-exe
go-package_darwin_amd64@0.0.17
os: darwin
cpu: x64
bin: /Users/<user>/go-package/dist/npm/dist-go-package-darwin-amd-64-v-1-go-package
go-package_darwin_arm64@0.0.17
os: darwin
cpu: arm64
bin: /Users/<user>/go-package/dist/npm/dist-go-package-darwin-arm-64-go-package
| GOOS | Node.js Platform |
|---|---|
| darwin | darwin |
| linux | linux |
| windows | win32 |
| android | android |
| aix | aix |
| freebsd | freebsd |
| openbsd | openbsd |
| solaris | sunos |
| netbsd | netbsd |
| GOARCH | Node.js Platform |
|---|---|
| amd64 | x64 |
| 386 | ia32 |
| arm | arm |
| arm64 | arm64 |
| s390x | s390x |
| s390 | s390 |
| riscv64 | riscv64 |
| ppc64 | ppc64 |
| ppc | ppc |
| mips | mips |
FAQs
Build and publish npm packages based on goreleaser output folder
The npm package goreleaser-npm-publisher receives a total of 4 weekly downloads. As such, goreleaser-npm-publisher popularity was classified as not popular.
We found that goreleaser-npm-publisher demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.

Research
A malicious package uses a QR code as steganography in an innovative technique.

Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.