
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
一个类似vue-cli的脚手架,用于学习脚手架开发理念:下载模板,通过命令行交互, 处理下载的模板
本项目基于:eos-cli
npm install koro-cli -g
mac环境下要加sudo
。
如果你用npm安装失败,报权限问题用sudo
也没有用,可以尝试一下用cnpm
。(我遇到了这个问题,现在也不知道为什么会这样!)
npm install
npm run watch
本地调试将配置文件放在项目中,方便调试:
// constants.js
// 配置文件目录
// export const RC = `${HOME}/.kororc`;
export const RC = `./.kororc`; //本地调试将配置文件放在项目中,方便调试
npm run postinstall
本地开发的时候需要创建该文件,发布到npm
上就不用了。
因为用户install
之后,会自动执行npm run postinstall
npm link
将package.json
上的配置,链接到全局, 此时就可以使用 koro
命令了。
mac 环境下要使用sudo npm link
才能链接全局环境。
本项目是一个学习项目, 项目内置模板为一个只有readme
的仓库,然后只是简单的把用户选项放到新创建的:answer.txt
文件中。
koro init testName // 下载模板到testName文件夹
koro config set registry OBKoro1 // 修改用户
koro config set templateName codeBlack // 修改仓库名
正常情况下:应该根据用户命令行交互的命令,通过node.js
来自定义项目模板,这一步需要大家自己做了。
开发完成后,即可发布至 npm, 用户通过 npm install koro-cli -g
全局安装。 即可使用 koro
命令
"bin": {
"else": "./bin/www"
}
注意postinstall
也要修改。
.kororc
文件改回去:// 配置文件目录
export const RC = `${HOME}/.kororc`; // 全局读取
// export const RC = `./.kororc`; // 本地调试将配置文件放在项目中,方便调试
FAQs
一个类似vue-cli的脚手架,用于学习脚手架开发理念:下载模板,通过命令行交互, 处理下载的模板
The npm package koro-cli receives a total of 9 weekly downloads. As such, koro-cli popularity was classified as not popular.
We found that koro-cli demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.