
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Not A Dotfile Manager — bootstrap jj as a dotfile manager.
nadm turns your home directory into a jj repository with a non-colocated git backend. You selectively track dotfiles with jj dot add, and nadm maintains the .gitignore so jj only sees what you've opted in.
Requires jj to be installed.
npx nadm init
jj dot add ~/.config/nvim
jj dot add ~/.zshrc
jj commit -m "add dotfiles"
npx nadm clone https://github.com/you/dotfiles.git
# or
npx nadm clone --github you/dotfiles
After initialization, nadm adds a jj dot alias with the following subcommands:
| Command | Description |
|---|---|
jj dot add <path>... | Track a file or directory |
jj dot forget <path>... | Stop tracking a file or directory |
jj dot sync | Regenerate .gitignore from the tracked list |
jj dot edit | Open ~/.nadm/tracked in $EDITOR, then sync |
Paths can be absolute or relative. Directories are tracked recursively.
npx nadm init creates a jj repo in ~ with jj git init --no-colocate~/.nadm/ directory holds the tracked file list, the dot.sh script, and a config.toml that registers the jj dot alias~/.gitignore starts by ignoring everything (*), then selectively unignores tracked paths and their parent directoriesjj dot add a path, it's appended to ~/.nadm/tracked and the gitignore is regeneratedSince jj uses a git backend, you can push your dotfiles to any git remote:
jj git remote add origin https://github.com/you/dotfiles.git
jj git push
After running nadm init, the following is created in your home directory:
~/
.jj/ # jj repository (non-colocated git backend)
.nadm/
tracked # plain text list of tracked paths
dot.sh # jj dot subcommand implementation
config.toml # jj config with the dot alias
.gitignore # auto-generated, do not edit directly
MIT
FAQs
Not A Dotfile Manager - bootstrap jj as a dotfile manager
The npm package nadm receives a total of 7 weekly downloads. As such, nadm popularity was classified as not popular.
We found that nadm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.