
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
Minstall is a local module installer, intended to be used as postinstall-script.
Let's say you have the following modular app, and run npm install on it:
my-modular-app
├── modules
│ ├── database
│ │ ├── index.js
│ │ └── package.json [requires mongoose and lodash]
│ └── tasks
│ ├── index.js
│ └── package.json [requires lodash and database]
├── index.js
└── package.json [requires express, uses database and tasks]
database and tasks) wouldn't work, because their dependencies are missing../modules/-prefixMinstall installs the necessary dependencies to the root-node_modules, and symlinks the modules there.
After running npm install with minstall as postinstall, the structure looks like this:
my-modular-app
├── modules
│ ├── database
│ │ ├── index.js
│ │ ├── node_modules
│ │ │ ├── lodash -> ../../../node_modules/lodash
│ │ │ └── mongoose -> ../../../node_modules/mongoose
│ │ └── package.json
│ └── tasks
│ │ ├── index.js
│ │ ├── node_modules
│ │ │ └── lodash -> ../../../node_modules/lodash
│ │ │ └── database -> ../../database
│ │ └── package.json
├── node_modules
│ ├── lodash
│ ├── minstall
│ └── mongoose
├── index.js
└── package.json
require('./modules/database')require('database')npm install minstall --savemodules-folder is optional, and defaults to modules if omitted"scripts": {
"postinstall": "minstall <modules-folder>"
}
Minstall knows the following flags:
--no-link prevents minstall from linking the local modules to the root-node_modules--link-only makes minstall go through the linking-process only, without installing anything--cleanup makes minstall remove all node_modules-folders before installing dependencies (this is forced for npm5)--dependency-check-only makes install print the dependency-check only, without touching any files or installing anything--assume-local-modules-satisfy-non-semver-dependency-versions (aka --trust-local-modules) makes minstall assume that a local module satisfies every requested version of that module that is not valid semver (like github-urls and tag-names)--loglevel <loglevel> sets the loglevel (error, warn, info verbose, debug, silly)--no-hoist <dependency>. makes minstall not hoist that dependency. <dependency> has the form name@versionRange, e.g. --no-hoist aurelia-cli@^0.30.1. If you omit the versionRange, no version of that dependency will be hoisted.
The name can be a glob expression (see minimatch), e.g. --no-hoist aurelia-*. This is useful for dependencies that don't play nice when hoisted/linked. This flag can be added multiple times.
FAQs
local module installer
The npm package minstall receives a total of 18 weekly downloads. As such, minstall popularity was classified as not popular.
We found that minstall demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.