Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
ipfs-npm-republish
Advanced tools
Republish your node project's dependencies to IPFS as a micro-registry
Republish your node project's dependencies to IPFS as a micro-registry
npm install -g ipfs-npm-republish
You also need IPFS running, I recommend installing IPFS Desktop.
To republish all the dependencies for your application, run the following command within folder with a package-lock.json present:
ipfs-npm-republish
To republish a specific module from npm along with it's dependencies to ipfs, run the following command passing the name of the package:
ipfs-npm-republish react
adding a version string also works:
ipfs-npm-republish react@16.8.6
You can also publish a new package directly to IPFS without needing to first publish to npmjs.org, run the following command within folder with a package.json present:
ipfs-npm-republish publish
To publish a second release to an existing package that was published to IPFS, you can pass the hash of the previous version of the registry:
ipfs-npm-republish publish bafybeiahqsziz6mxofxlvx3baqcrihjicxoh27mcg4eukwybvb2u7whuzm
You can also merge two micro-registries together:
ipfs-npm-republish merge bafybeib7yv2z6bgmzphqjuexdb6smfah6pitmah4hzqb7rw7yjzmwocb6e bafybeic3ldukh6jfg2wq4fhrigtvgnf5lml6wo5qdkmsdlr3ieo63qczyu
1. List dependencies for current directory from package-lock.json
2. Calculate list of packages to be republished
3. create an folder to act as ROOT
4. For each package
1. Fetch packuments for each package and write to ROOT
2. For each depended upon version:
1. download the tarball to ROOT
2. ipfs add tarball
3. rewrite the dist.tarball url to a local gateway url with tarball hash
5. ipfs add -r ROOT
7. set per-project npm config to use new micro-registry
8. output command to update registry to point to ipfs ROOT hash
MIT
FAQs
Republish your node project's dependencies to IPFS as a micro-registry
We found that ipfs-npm-republish demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.