
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
ncmp-copy-plugin
Advanced tools
NCMP plugin for copying files from node_modules into another file structure.
npm install ncmp-copy-plugin
Use this to copy files which are runtime dependencies of your client application to another folder structure outside of node_modules.
You have to extend the ncmp.json configuration file as described below:
{
"destinations": {
"*.css": "content/components",
"aurelia-*.js": "scripts/components/aurelia/*",
"*": "scripts/components",
},
"plugins": ["copy"]
}
Add the word "copy" to the correct position in the "plugins" array.
It defines the destination folders depending on a regular expression which is executed against the file basename. The base path is the root folder. In this example we want to copy the distributions from jquery. The tool will perform the following copy actions:
| Source | Destination |
|---|---|
| ./node_modules/jquery/dist/jquery.js | ./scripts/components/jquery.js |
| ./node_modules/jquery/dist/jquery.min.js | ./scripts/components/jquery.min.js |
| ./node_modules/aurelia-framework/dist/amd/aurelia-framework.js | ./scripts/components/aurelia/framework/aurelia-framework.js |
| ./node_modules/aurelia-templating/dist/amd/aurelia-templating.js | ./scripts/components/aurelia/templating/aurelia-templating.js |
You can also define a single source file instead of an array.
You can use globs everywhere in the source file paths:
dist/*.js
dist/jquery.*
dist/*.min.js
See main documentation for additional information.
MIT
FAQs
NCMP plugin for copying files
The npm package ncmp-copy-plugin receives a total of 0 weekly downloads. As such, ncmp-copy-plugin popularity was classified as not popular.
We found that ncmp-copy-plugin demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.