
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
hammerpack
Advanced tools
Hammerpack is an opinionated development, test, build, and deployment system for javascript projects.
Hammerpack is an opinionated development, test, build, and deployment system for javascript projects.
Warning: Hammerpack is in the alpha stage.
Hammerpack is strongly opinionated about the following:
If done right, monolithic repositories vastly improve productivity when setting up development environments, building projects, sharing code, sharing third-party dependencies, code discovery, refactoring, testing, and more.
For example, having one package.json in the root of the repository that covers dependencies across all projects has the following advantages:
You no longer need to have your browser, backend, react-native code in separate repositories. By placing them all organized in the same repo, you get the advantage of easier code sharing and better understanding of the entire codebase.
Another advantage you will get is faster development and publishing cycles. For example, with Hammerpack you will now be to use the same commands for developing, testing, building, deploying, and running any type of project. This means faster onboarding of new developers, and using the same scripts in your CI/CD pipelines.
When it comes to developing, building, packaging, and deploying the different types of projects, Hammerpack will ensure there is no leakage of one platform's specific technologies into another platform. This is because Hammerpack will generate optimized builds for the targeted platforms.
Traditionally, the downside of monolithic repositories is that builds would compile all projects, regardless of whether or not any of the projects have changed. This meant that:
Hammerpack can detect if there have been any changes to any of the following as compared to previous stages:
Hammerpack uses the above data to generate a unique hash, which it then uses to track and determine if it should rebuild, retest and redeploy on a per-project basis. This greatly improves CI/CD times.
(This feature is yet to be released)
The immediate knee-jerk reaction to monolithic repositories that share code is the concern of high-coupling between code components. Hammerpack is also of the opinion that high-coupling is bad, and that projects need to define clear code boundaries to prevent high-coupling.
This is why Hammerpack takes measures to allow building enforceable code layering constraints. For example, you can tell Hammerpack
that your src-web and src-ios folders can use code from src-shared and nothing else. Then, any attempts by a
developer to use code from src-web inside the src-ios folder will result in errors.
(This feature is yet to be released)
You should not spend time on configuring tools for development, testing, building, deploying, running. Instead, you should focus on your project.
You should be able to just point Hammerpack to a minimal configuration and it should just work.
npm install -g hammerpack
MIT
FAQs
Hammerpack is an opinionated development, test, build, and deployment system for javascript projects.
We found that hammerpack demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.