Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Scaffold TypeScript npm packages using this template to bootstrap your next library.
Scaffold TypeScript npm packages using this template to bootstrap your next library.
This project includes:
Versions of this template:
Begin via any of the following:
Press the "Use this template" button
Use degit to execute:
degit github:jasonsturges/typescript-npm-package
Use GitHub CLI to execute:
gh repo create <name> --template="https://github.com/jasonsturges/typescript-npm-package"
Simply git clone
, delete the existing .git folder, and then:
git init
git add -A
git commit -m "Initial commit"
Remember to use npm search <term>
to avoid naming conflicts in the NPM Registery for your new package name.
The following tasks are available for npm run
:
dev
: Run Rollup in watch mode to detect changes to files during developmentbuild
: Run Rollup to build a production release distributablebuild:types
: Run Microsoft API Extractor to rollup a types declaration (d.ts
) filedocs
: Run TypeDoc for TSDoc generated documentation in the "docs/" folderclean
: Remove all build artifactsWhile test driven development (TDD) would be a good approach to develop your library, also consider creating an app for prototyping and local testing of your library.
To test within the library, consider using Storybook. This approach runs a storybook
script to load local source files for development.
Otherwise, follow these steps to test the package from another project:
From your library project, issue the npm link
(or yarn link
) command:
npm link
Start Rollup in watch mode:
npm run dev
Create a test app project, by doing the following:
To use your npm package library locally for development, create a new project in a separate folder:
mkdir test-app && cd test-app
npm init
Take the defaults from npm init
; then, add TypeScript:
npm install typescript --save-dev
In the package.json of your test app, add the following two things:
type
of your package to module
start
script to execute your app"type": "module",
"scripts": {
"start": "tsc && node index.js",
},
Link to your library using the npm link <name>
(or yarn link <name>
) command - be sure the <name>
matches your library's package.json name. For example:
npm link typescript-npm-package
Add a "tsconfig.json" file to your test app that includes a baseUrl
and references the paths
to your npm linked module. Again, be sure the paths
name matches your library's package.json name. For example:
{
"compilerOptions": {
"target": "es6",
"module": "esnext",
"moduleResolution": "node",
"strict": true,
"esModuleInterop": true,
"baseUrl": ".",
"paths": {
"typescript-npm-package": ["node_modules/typescript-npm-package/src"],
"typescript-npm-package/*": ["node_modules/typescript-npm-package/src/*"]
}
}
}
Now, run your app via npm start
.
As an example, if your library's "index.ts" file contained:
export const sayHi = () => {
console.log("Hi");
};
...your test app would implement an import using your package name, such as:
import { sayHi } from "typescript-npm-package";
sayHi();
Once development completes, unlink
both your library and test app projects.
From your test app project, unlink the library using npm unlink <name>
(or yarn unlink <name>
) command:
npm unlink typescript-npm-package
From your library project, issue the npm unlink
(or yarn unlink
) command:
npm unlink
Update your package.json
to next version number, and remember to tag a release.
Once ready to submit your package to the NPM Registry, execute the following tasks via npm
(or yarn
):
npm run clean
— Assure a clean buildnpm run build
— Build the packagenpm run build:types
— Build API Extractor d.ts declarationAssure the proper npm login:
npm login
Submit your package to the registry:
npm publish --access public
FAQs
Scaffold TypeScript npm packages using this template to bootstrap your next library.
The npm package gptindex receives a total of 0 weekly downloads. As such, gptindex popularity was classified as not popular.
We found that gptindex demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.