
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
It is a tool for controlling multiple projects (called packages in laoban-speak). While it is fairly language agnostic it
probably offers the most value to javascript/typescript projects in a monorepo.
laoban then start herelaoban on your package start hereIf you have tried to use lerna or yarn workspaces and found them lacking then this might be for you.
It is useful if you want to have a typescript project made of small chunks of code (a main + libraries) or want to control and manage dependencies / tech stack at 'the team level' or 'the organisation level'
npm does not handle multiple packages well. Each package is a separate package.json that is managed separately. There
is no ability to 'inherit' or share configuration, so in a package with many moving parts each of which is implemented
with a small bit of javascript/typescript, it can be difficult to keep all the dependencies in line.
In the past I have found myself making a whole raft of scripts, and then forgetting which one was which / how they worked
/ how to modify them. Copying them for use in other packages was problematic and prone to error. Most of the logic in the
script was the same, and can be generalised across multiple packages. laoban is the result of
refactoring these scripts and making them more declarative.
Laoban is not very opinionated about which one to use. Replacing npm with yarn in the config will let you use all the features with yarn. If
you want to use it with maven or sbt or... it works fine (although those other language tools already have much of the capabilities
that laoban brings to the javascript world). By 'not very opinionated' we mean
'you should be using yarn workspaces in a monorepo world, but if you don't want to you can use npm... but your
life will be much harder'
laoban updatelaoban compilelaoban testlaoban statuslaoban update --minor or laoban update --majorgit clone the projectyarn to download all the dependencieslaoban compile will compile the packages in the correct orderlaoban test will test the packageslaoban status will let you see which packages compiled and passed all their testslaoban update --minor will update all the packages to the new minor version number (or you can use --major or --setVersion xxx)laoban publish will publish all the packageslaobanI tried every 'boss' or 'controller' word I could think of! Laoban is Chinese for 'boss' and wasn't taken on npmjs (although it was on github)
FAQs
A cli for managing projects that have many npm packages
The npm package laoban receives a total of 4 weekly downloads. As such, laoban popularity was classified as not popular.
We found that laoban demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.