
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
meta-release
Advanced tools
Plugin to meta that will cascade publish meta projects.
The Meta Release plugin will use the following package scripts:
release - Run to publish the package, generally this is the standard publish commandAccording to npm scripts, it will do the prerelease and postrelease if exists.
To install the plugin:
npm install --save meta-release
This command will bump the version of the specified project, then look into the meta setup to find for dependent projects. This also include transitive dependencies, where if A is the project with new version and B is a dependent of A and it is also released, then any dependents of C will also be included.
To run
meta release-version <projectName> [projectVersion]
Use the -h flag to see all options (including dry-run).
This command will bump the version of a specified project / dependency, then look into the meta setup to find for dependent projects. This is useful if the first command fails on some projects, and you have manually fix that particular failing project, and want to continue to it's dependents. For those projects that were already in your release path, ensure that you select "i" to include them or the transitive dependency will not be included in release.
To run
meta release-dependentVersion <projectName> [projectVersion]
Use the -h flag to see all options (including dry-run).
FAQs
Manage release and publishing of versions with meta
The npm package meta-release receives a total of 1 weekly downloads. As such, meta-release popularity was classified as not popular.
We found that meta-release demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.