
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
NodeJS application to native executable
js2bin is a command line utility that helps package a bundled (think webpack, rollup etc) NodeJS application into a native executable. See How it works for more info.
Shipping a native binary has a number of benefits over shipping a bundled .js file
Benefits for you
UglifyJS can providenode (on some platforms it can be a challenge)Benefits for your user/customer:
node/npmNOTE:
js2bin take the form --option or --option=value--option=a --option=bMake an executable of your application for MacOS:
js2bin --build --platform=darwin --node=10.16.0 --app=/path/to/my/app.js --name=CoolAppName
this will create a file named CoolAppName-darwin-x64 on your current working directory - if you're on a Mac you'll be able to execute it. Go ahead try it!
Make an executable of your application for MacOS and Linux:
js2bin --build --platform=darwin --platform=linux --node=10.16.0 --app=/path/to/my/app.js --name=CoolAppName
this will create 2 files named CoolAppName-darwin-x64 and CoolAppName-linux-x64 on your current working directory - if you're on Mac or Linux you'll be able to execute either of them. Go ahead try it!
In case where you want to build for a version of Node for which a prebuild binary does not exist you'll need to follow a 2 step process
js2bin --ci --cache --node=10.13.0 --size=2MB
js2bin --build --cache --node=10.13.0 --app=/path/to/my/app.js --name=CoolAppName
--help: print this help message
--build: embed your application into the precompiled NodeJS binary.
--node: NodeJS version(s) to use, can specify more than one.
e.g. --node=10.16.0 --node=12.4.0
--platform: Platform(s) to build for, can specifiy more than one.
e.g. --platform=linux --plaform=darwin
--app: Path to your (bundled) application.
e.g. --app=/path/to/app/index.js
--name: Application name (optional)
--dir: (opt) Working directory, if not specified use cwd
e.g. --dir=/tmp/js2bin
--cache (opt) Cache any pre-built binaries used, to avoid redownload
--ci: build NodeJS with preallocated space for embedding applications
--node: NodeJS version to build from source, can specify more than one.
e.g. --node=10.16.0
--size: Amount of preallocated space, can specify more than one.
e.g. --size=2MB --size==4MB
--dir: (opt) Working directory, if not specified use cwd
--cache: (opt) whether to keep build in the cache (to be reused by --build)
--upload: (opt) whether to upload node build to github releases
--clean: (opt) whether to clean up after the build
While we've tried to minimize the amount of code changes needed when developing and testing using node and shipping a native binary, there are a few things you need to keep in mind:
process.argv - js2bin inserts and fake argument in process.argv[1] = cwd()/<app-name>.js. This ensures minimal code changes, but if your application depends on using that file (highly unlikely) that file won't be there.child_process.fork - if you're application uses this NodeJS specific forking method (to spawn more copies of itself) then you'll need to distinguish between node mode and bundled app - if(path.basename(process.execPath) === 'node') {
child_process.fork(....)
} else {
child_process.spawn(process.execPath, ...)
}
NodeJS provides compile time hooks for changing the behavior of the resulting binary, usually node. This is done by allowing users to (a) place their code in lib/_third_party_main.js, (b) modifying node.gyp to include that file in the build and then recompile. Once node is compiled, at startup controll will be passed to lib/_third_party_main.js as early as possible. There are some caveats tho:
--version)clustering) that are not set upprocess.argv would be different when your app is started this way (only relevant if you want to develop using node but ship your app bundled up)While the above is pretty straightforward it suffers from two problems:
node after every change to your applicationnode can take time - think 20+ minutes (if you're on a laptop) - thus, less than ideal development experience.Now, imagine if we changed the node build process to be a two step process:
node with some placeholder content, large enought to fit our application and cache it.This is exactly what js2bin does - with the following specs/modifications:
node binaries are prebuilt for a number of platforms with placeholder content for 2 and 4MB in sizeFAQs
Native binary for your NodeJS apps
The npm package js2bin receives a total of 17 weekly downloads. As such, js2bin popularity was classified as not popular.
We found that js2bin demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.