
Research
Security News
Malicious PyPI Package Exploits Deezer API for Coordinated Music Piracy
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
No more struggles setting up new JavaScript repository. Kick-start single-purpose repos, monorepos, monorepo workspaces and common tooling:
# initialize a monorepo
yarn dlx moker create --monorepo my-repo
cd my-repo
# install common tools
yarn moker use prettier husky lint-staged doctoc semantic-release
# create workspaces
yarn moker add --template express server
yarn moker add --template cra client
🤓 The core plugins make some assumptions you may not agree with. If that's the case, this tool is probably not for you. The defaults used are documented below and marked with a nerd-face emoji so you should be able to get a clear picture of what to expect.
You will need Node v14+ and Yarn v2+ in order to use moker
.
corepack enable
corepack prepare yarn@stable --activate
Create a new monorepo:
yarn dlx moker create --monorepo my-repo
This will initialize a new monorepo in the my-repo
directory.
⚠️ Note that we use
yarn dlx moker
to create a new monorepo. Once we are inside our monorepo, we can simply useyarn moker
to execute commands.
🤓 The monorepo is initiated with Yarn without Zero-Installs and in legacy
nodeLinker: node-modules
mode because a lot of packages are not yet compatible with PnP or require a workaround.
Of course you want additional tools installed at the monorepo level, add them with:
cd my-repo
yarn moker use prettier husky lint-staged
Plugins may work together. For example, lint-staged
will install a pre-commit
hook which formats code if prettier
and husky
are installed. The order in
which plugins are added does not matter.
See the section available plugins for a list of options.
💡 To quickly get started with the most common plugins, use a monorepo template like so:
yarn dlx moker create --template common my-repo
To add a new workspace (a.k.a. monorepo package) to your monorepo, use:
yarn moker add my-workspace
Workspaces are added in a customizable subdirectory of the monorepo (the default
is packages
).
You can also use a workspace template, e.g.:
yarn moker add --template lib shared
yarn moker add --template express server
yarn moker add --template cra client
yarn moker add --template bandersnatch cli
See the section available templates for a list of options.
dependabot
monorepoThis plugin adds a Dependabot configuration to your monorepo with an updater for NPM packages.
If you have the github-actions
plugin installed, it will add an updater for
GitHub Actions workflows.
devcontainer
monorepoThis plugin creates a Development Containers
configuration using the
typescript-node
image.
If you have the prettier
plugin installed, it will add the
Prettier VS Code extension.
doctoc
monorepoThis plugin adds a script to generate a table of contents for the README using doctoc.
If you have the husky
plugin installed, it will also add a pre-commit hook.
github-actions
monorepoThis plugin creates a simple ci.yml
GitHub Actions workflow.
If you have the prettier
plugin installed, this will also setup a lint.yml
workflow.
If you have the semantic-release
plugin installed, this will also setup a
release.yml
workflow. This workflow needs these secrets to be added to your
repository:
GH_TOKEN
: a GitHub token with read/write access to your repositoryNPM_TOKEN
: an NPM token with publish access to your packages🤓 The workflows will use the
main
branch by default, but it is trivial to change this.
husky
monorepoThis plugin sets up Husky at the monorepo level.
jest
workspaceThis plugin sets up Jest and adds a test
and test:watch
script to both the workspace and the monorepo.
lint-staged
monorepoThis plugin sets up lint-staged at the monorepo level.
If you have the prettier
plugin installed, this will setup a task to format
staged files using prettier --write --ignore-unknown
.
If you have the husky
plugin installed, this will setup a pre-commit hook to
run yarn lint-staged
.
prettier
monorepoThis plugin sets up Prettier.
🤓 Prettier is installed with this configuration:
proseWrap: always
We only set this
proseWrap
override because we think markdown files should always be truncated to match whatever theprintWidth
setting is. This makes it so much easier to read and write markdown files!
semantic-release
monorepo⚠️ This is work in progress
Current plan:
yarn npm publish
"private": true
in root package"publishConfig"
in workspaces pkgprepublishOnly
to prepublish
This may be outdated:
This plugin sets up
semantic-release. It
uses a workaround so that it can be used in a monorepo, which is to set up a
.npmrc
file containing:
workspaces = true
workspaces-update = false
This causes both npm version
and npm publish
to be run for each monorepo in
the semantic-release
context.
Please note that the root repository is not published. Furthermore, make sure
that the root package.json
doesn't contain:
"private": true
Otherwise, the semantic-release
process will skip the publish
step.
🤓 The release configuration will use the
main
branch by default, but it is trivial to change this.
⚠️ The semantic-release plugin in our monorepo configuration is currently broken due to an issue with their npm plugin (see semantic-release/npm#529) [this issue with their npm a]. Take a look at patch-semantic-commit.js in this repository for a workaround.
todos
workspaceThis plugin adds a script to generate a TODO markdown file from all code annotations using leasot.
If you have the husky
plugin installed, it will also add a pre-commit hook.
typescript
workspaceThis plugin sets up TypeScript and adds a
build
and build:watch
script to both the workspace and the monorepo.
bandersnatch
workspaceScaffolds a simple bandersnatch CLI app tool with the typescript and jest plugins.
common
monorepoThis is the only monorepo template at this point. It simply installs all available monorepo plugins.
cra
workspaceUses create-react-app to scaffold a React.js app (web client).
express
workspaceScaffolds a simple express HTTP app with the typescript and jest plugins.
lib
workspaceA plain shared library template with the typescript and jest plugins.
Contributions are very welcome!
swc
/esbuild
Also see TODO.md.
To run the moker
CLI from source, run:
yarn start
Note that you can create a new monorepo for testing purposes outside the current working directory with:
yarn start create /path/to/my-repo
A devcontainer configuration is included in this repo to get started quickly.
©️ Copyright 2022 Joram van den Boezem
♻️ Licensed under the MIT license
🤔 Moker? MOnorepo KickstartER
FAQs
The moker CLI
The npm package moker receives a total of 125 weekly downloads. As such, moker popularity was classified as not popular.
We found that moker demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.
Security News
Newly introduced telemetry in devenv 1.4 sparked a backlash over privacy concerns, leading to the removal of its AI-powered feature after strong community pushback.