
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
ipfs-npm-republish
Advanced tools
Republish your node project's dependencies to IPFS as a micro-registry
Republish your node project's dependencies to IPFS as a micro-registry
npm install -g ipfs-npm-republish
You also need IPFS running, I recommend installing IPFS Desktop.
To republish all the dependencies for your application, run the following command within folder with a package-lock.json present:
ipfs-npm-republish
To republish a specific module from npm along with it's dependencies to ipfs, run the following command passing the name of the package:
ipfs-npm-republish react
adding a version string also works:
ipfs-npm-republish react@16.8.6
You can also publish a new package directly to IPFS without needing to first publish to npmjs.org, run the following command within folder with a package.json present:
ipfs-npm-republish publish
To publish a second release to an existing package that was published to IPFS, you can pass the hash of the previous version of the registry:
ipfs-npm-republish publish bafybeiahqsziz6mxofxlvx3baqcrihjicxoh27mcg4eukwybvb2u7whuzm
You can also merge two micro-registries together:
ipfs-npm-republish merge bafybeib7yv2z6bgmzphqjuexdb6smfah6pitmah4hzqb7rw7yjzmwocb6e bafybeic3ldukh6jfg2wq4fhrigtvgnf5lml6wo5qdkmsdlr3ieo63qczyu
1. List dependencies for current directory from package-lock.json
2. Calculate list of packages to be republished
3. create an folder to act as ROOT
4. For each package
1. Fetch packuments for each package and write to ROOT
2. For each depended upon version:
1. download the tarball to ROOT
2. ipfs add tarball
3. rewrite the dist.tarball url to a local gateway url with tarball hash
5. ipfs add -r ROOT
7. set per-project npm config to use new micro-registry
8. output command to update registry to point to ipfs ROOT hash
MIT
FAQs
Republish your node project's dependencies to IPFS as a micro-registry
The npm package ipfs-npm-republish receives a total of 21 weekly downloads. As such, ipfs-npm-republish popularity was classified as not popular.
We found that ipfs-npm-republish demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.