Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
No more struggles setting up monorepo tooling. Kick-start monorepos and workspaces fast:
# initialize a monorepo
yarn dlx moker create my-monorepo
cd my-monorepo
# install common tools
yarn moker use prettier husky lint-staged github-actions devcontainer
# create workspaces
yarn moker add --template express server
yarn moker add --template cra client
🤓 The core plugins make some assumptions you may not agree with. If that's the case, this tool is probably not for you. The defaults used are documented below and marked with a nerd-face emoji so you should be able to get a clear picture of what to expect.
You will need Node v14+ and Yarn v3+ in order to use moker
.
corepack enable
corepack prepare yarn@stable --activate
Create a new monorepo:
yarn dlx moker create my-repo
This will initialize a new monorepo in the my-repo
directory.
⚠️ Note that we use
yarn dlx moker
to create a new monorepo. Once we are inside our monorepo, we can simply useyarn moker
to execute commands.
🤓 The monorepo is initiated with Yarn without Zero-Installs and in legacy
nodeLinker: node-modules
mode because a lot of packages are not yet compatible with PnP or require a workaround.
Of course you want additional tools installed at the monorepo level, add them with:
cd my-repo
yarn moker use prettier husky lint-staged
Plugins may work together. For example, lint-staged
will install a pre-commit
hook which formats code if prettier
and husky
are installed. The order in
which plugins are added does not matter.
See the section available plugins for a list of options.
💡 To quickly get started with the most common plugins, use a monorepo template like so:
yarn dlx moker create --template common my-repo
To add a new workspace (a.k.a. monorepo package) to your monorepo, use:
yarn moker add my-workspace
Workspaces are added in a customizable subdirectory of the monorepo (the default
is packages
).
You can also use a workspace template, e.g.:
yarn moker add --template lib shared
yarn moker add --template express server
yarn moker add --template cra client
yarn moker add --template bandersnatch cli
See the section available templates for a list of options.
devcontainer
monorepo🚧 This plugin is a work in progress
This plugin sets up devcontainer configuration at the monorepo level.
github-actions
monorepo🚧 This plugin is a work in progress
This plugin sets up GitHub Actions at the monorepo level.
husky
monorepoThis plugin sets up Husky at the monorepo level.
lint-staged
monorepoThis plugin sets up lint-staged at the monorepo level.
If you have the prettier
plugin installed, this will setup a task to format
staged files using prettier --write --ignore-unknown
.
If you have the husky
plugin installed, this will setup a pre-commit hook to
run yarn lint-staged
.
prettier
monorepoThis plugin sets up Prettier.
🤓 Prettier is installed with this configuration:
proseWrap: always
We only set this
proseWrap
override because we think markdown files should always be truncated to match whatever theprintWidth
setting is. This makes it so much easier to read and write markdown files!
jest
workspaceThis plugin sets up Jest and adds a test
and watch:test
script to both the workspace and the monorepo.
typescript
workspaceThis plugin sets up TypeScript and adds a
build
and watch:build
script to both the workspace and the monorepo.
common
monorepoThis is the only monorepo template at this point. It simply installs these plugins in the monorepo:
prettier
husky
lint-staged
github-actions
devcontainer
bandersnatch
workspaceScaffolds a simple bandersnatch CLI app tool with the typescript and jest plugins.
cra
workspaceUses create-react-app to scaffold a React.js app (web client).
express
workspaceScaffolds a simple express HTTP app with the typescript and jest plugins.
lib
workspaceA plain shared library template with the typescript and jest plugins.
Contributions are very welcome!
swc
/esbuild
Also see TODO.md.
To run the moker
CLI from source, run:
yarn start
Note that you can create a new monorepo for testing purposes outside the current working directory with:
yarn start create /path/to/my-repo
A devcontainer configuration is included in this repo to get started quickly.
©️ Copyright 2022 Joram van den Boezem
♻️ Licensed under the MIT license
🤔 Moker? MOnorepo KickstartER
FAQs
The moker CLI
The npm package moker receives a total of 50 weekly downloads. As such, moker popularity was classified as not popular.
We found that moker demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.