
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
loose-dependency-manager
Advanced tools
Wire-up fragmented codes and files from various sources with a single command.
Wire-up fragmented codes and files from various sources with a single command.
Documentation | Getting Started | Examples
What is loose dependency manager?
Loose Dependency Manager (ldm) is a tool that helps you manage dependencies from various sources in a single file.
You can think of it as a sophisticated form of scp command
that can be configured with a single specification file (ldm.yaml)
and that supports versioning (if the remote source supports it) and locking mechanism.
Currently, it supports the following sources:
| Provider | Versioning Support | Can Download | URI Format |
|---|---|---|---|
| HTTP(S) | ❌ | only files | HTTP(S) URL |
| GitHub | ✅ | files & directories | <github-source-id>:///path/to/file |
| JSDelivr (npm) | ✅ | files & directories | <jsdelivr-npm-source-id>://default or <jsdelivr-npm-source-id>:///path/to/file |
| JSDelivr (github) | ✅ | files & directories | <jsdelivr-github-source-id>:///path/to/file |
Before installing ldm, you need to have Node.js installed.
npm install -g loose-dependency-manager
You write a dependency specification file named ldm.yaml.
[!IMPORTANT] It is stronlgly recommended to set
auth.tokenwith personal access token when using GitHub as a source provider (even if you're using for public repositories). Github API imposes a harsh rate limit of 60 requests per hour for unauthenticated requests, so you may run into rate limit issues without a token.
version: "1"
dependencies:
primitive.ts:
uri: "@ts-essentials/ts-essentials:///lib/primitive/index.ts"
version: latest
destination: src/types/primitive.ts
camel-case:
uri: "@ts-essentials/ts-essentials:///lib/camel-case"
version: latest
destination: src/types/camel-case
jquery:
uri: jquery://default
version: ^3.6.4
destinations:
- src/core.min.js
- public/js/core.min.js
reset.css:
uri: https://meyerweb.com/eric/tools/css/reset/reset200802.css
destination: public/css/reset.css
pico.css:
uri: "@picocss/pico:///css/pico.min.css"
version: ^2.0.0
destination: public/css/pico.min.css
sources:
"@ts-essentials/ts-essentials":
provider: github
uri: ts-essentials/ts-essentials
auth:
token: ${GITHUB_TOKEN}
jquery:
provider: jsdelivr:npm
uri: jquery
"@picocss/pico":
provider: jsdelivr:npm
uri: "@picocss/pico"
config:
envFile: .env
deleteFilesOnRemove: true
For better editing experience, YAML validation is supported thanks to JSON schema and YAML VSCode Extension (by RedHat).
To enable YAML validation,
.vscode/settings.json file.
{
"yaml.schemas": {
"https://raw.githubusercontent.com/ldm-org/ldm/refs/heads/master/schema.json": "**/ldm.yaml"
}
}
Then in terminal, run the following command.
ldm install
This will produce the following file sturcture,
assuming that ldm.yaml is the only file in the directory.
|- ldm.yaml
|- ldm-lock.yaml
|--- src/
|----- core.min.js
|----- types/
|------- primitive.ts
|------- camel-case/
|--------- index.ts
|--------- README.md
|--- public/
|----- css/
|------- reset.css
|------- pico.min.css
|----- js/
|------- core.min.js
The example above can be summarized as following diagram.

Documentation is not written yet. I'll try my best to write it as soon as possible.
You can find examples at e2e test scenarios.
Compare given and expected directory in each scenario
to see what the execution of scenario.ts#scenario.command will produce.
MIT License © 2025-Present Joseph Hwang
FAQs
Wire-up fragmented codes and files from various sources with a single command.
We found that loose-dependency-manager demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.