Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
node-gyp is a cross-platform command-line tool written in Node.js for compiling native addon modules for Node.js. It uses node.js's build system and requires Python, making it a complex but powerful tool for building and managing native modules.
Building native addon modules
This command compiles the native addon module for the current platform. It needs to be run in the root directory of the module.
node-gyp rebuild
Configuration
This command generates appropriate project build files for the current platform. It can be used before 'node-gyp build' to configure the project.
node-gyp configure
Compiling
This command compiles the native addon module using the generated build files. It should be run after 'node-gyp configure'.
node-gyp build
Cleaning
This command removes any build artifacts or temporary files created during the build process.
node-gyp clean
node-pre-gyp allows for publishing and installing Node.js C++ addons from binaries. It is similar to node-gyp but focuses on the end-user experience by facilitating the deployment of pre-compiled binaries.
neon-cli is a tool for building native Node.js modules with Rust. It provides an alternative to node-gyp for developers who prefer Rust over C++ for writing high-performance Node.js native modules.
cmake-js is a Node.js native addon build tool which works like node-gyp but uses CMake for building the native modules. It is useful for projects that already use CMake as their build system.
node-ninja is a small build system with a focus on speed. It is similar to node-gyp but uses the Ninja build system instead of Make or Visual Studio project files.
node-gyp
is a cross-platform command-line tool written in Node.js for compiling
native addon modules for Node.js, which takes away the pain of dealing with the
various differences in build platforms. It is the replacement to the node-waf
program which is removed for node v0.8
. If you have a native addon for node that
still has a wscript
file, then you should definitely add a binding.gyp
file
to support the latest versions of node.
Multiple target versions of node are supported (i.e. 0.6
, 0.7
,..., 1.0
,
etc.), regardless of what version of node is actually installed on your system
(node-gyp
downloads the necessary development files for the target version).
You can install with npm
:
$ npm install -g node-gyp
You will also need to install:
python
make
v2.7.3
recommended, v3.x.x
is not supported)To compile your native addon, first go to its root directory:
$ cd my_node_addon
The next step is to generate the appropriate project build files for the current
platform. Use configure
for that:
$ node-gyp configure
Note: The configure
step looks for the binding.gyp
file in the current
directory to processs. See below for instructions on creating the binding.gyp
file.
Now you will have either a Makefile
(on Unix platforms) or a vcxproj
file
(on Windows) in the build/
directory. Next invoke the build
command:
$ node-gyp build
Now you have your compiled .node
bindings file! The compiled bindings end up
in build/Debug/
or build/Release/
, depending on the build mode. At this point
you can require the .node
file with Node and run your tests!
Note: To create a Debug build of the bindings file, pass the --debug
(or
-d
) switch when running the either configure
or build
command.
Previously when node had node-waf
you had to write a wscript
file. The
replacement for that is the binding.gyp
file, which describes the configuration
to build your module in a JSON-like format. This file gets placed in the root of
your package, alongside the package.json
file.
A barebones gyp
file appropriate for building a node addon looks like:
{
"targets": [
{
"target_name": "binding",
"sources": [ "src/binding.cc" ]
}
]
}
Some additional resources for writing gyp
files:
node-gyp
responds to the following commands:
Command | Description |
---|---|
build | Invokes make /msbuild.exe and builds the native addon |
clean | Removes any the build dir if it exists |
configure | Generates project build files for the current platform |
rebuild | Runs "clean", "configure" and "build" all in a row |
install | Installs node development header files for the given version |
list | Lists the currently installed node development file versions |
remove | Removes the node development header files for the given version |
(The MIT License)
Copyright (c) 2012 Nathan Rajlich <nathan@tootallnate.net>
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the 'Software'), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
FAQs
Node.js native addon build tool
The npm package node-gyp receives a total of 12,212,845 weekly downloads. As such, node-gyp popularity was classified as popular.
We found that node-gyp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.