
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Easily convert your Node.js application into an executable with SEA (Single Executable Application)
🚀 Easily convert your Node.js application into an executable with SEA (Single Executable Application).
Supported on: Windows, macOS, Linux
Made with ❤️ by Klicat - France
npm install --save-dev node2exe
In your project, run:
npx node2exe
npx node2exe -V
This generates app-1.0.0.exe (or app-1.0.0 on macOS/Linux) based on your package.json version.
Add to your package.json:
{
"scripts": {
"build:exe": "node2exe"
}
}
Then run:
npm run build:exe
npm run build:exe -- -V # with version
package.json main field (e.g., server.js, app.js, index.js)package.json fileNote: The executable name is based on the main field filename. If not defined, it defaults to app.
app.exe (Windows executable)app.exeapp (macOS executable)./app in terminalapp (Linux executable)./app in terminalpackage.json main fieldpostject if not already presentsea-config.json automatically# Installation
npm install --save-dev node2exe
# Usage
npx node2exe
# Result
# ✅ app.exe created! (Windows)
# ✅ app created! (macOS/Linux)
app.exe / app - Your final executable (ready to distribute)sea-config.json - SEA configuration (optional after creation)node_modules/ - Contains postject and dependencies⚠️ SEA (Single Executable Applications) only supports CommonJS modules (require), not ES Modules (import).
However, with node2exe's automatic bundling, you can write in ES Modules! Here's how:
import colors from 'colors';
import https from 'https';
console.log('Hello'.blue);
const colors = require('colors');
const https = require('https');
console.log('Hello'.blue);
Don't forget to add "type": "module" to package.json:
{
"name": "my-app",
"version": "1.0.0",
"type": "module",
"main": "server.js"
}
Your code:
import express from 'express';
import colors from 'colors';
const app = express();
const PORT = 3000;
app.get('/', (req, res) => {
console.log(colors.blue('→ Request received on /'));
res.send('Hello World from Express!');
});
app.listen(PORT, () => {
console.log(colors.green(`✓ Server running on http://localhost:${PORT}`));
});
{
"name": "my-app",
"version": "1.0.0",
"main": "server.js"
}
Your code:
const express = require('express');
const colors = require('colors');
const app = express();
const PORT = 3000;
app.get('/', (req, res) => {
console.log(colors.blue('→ Request received on /'));
res.send('Hello World from Express!');
});
app.listen(PORT, () => {
console.log(colors.green(`✓ Server running on http://localhost:${PORT}`));
});
Some advanced ES Module features may not work:
import() at runtimeawait outside async functionSimple rule: If your imports look straightforward, they'll work!
Official documentation: https://nodejs.org/api/single-executable-applications.html
"The single executable application feature currently only supports running a single embedded script using the CommonJS module system."
The name of your executable is automatically determined by the main field in your package.json:
main defined{
"name": "my-project",
"main": "server.js",
"version": "1.0.0"
}
Running npx node2exe creates: server.exe (or server on macOS/Linux)
{
"name": "my-project",
"version": "1.0.0"
}
Running npx node2exe creates: app.exe (default name, since main is not defined)
{
"name": "my-project",
"main": "index.js",
"version": "2.5.0"
}
Running npx node2exe -V creates: index-2.5.0.exe
main field from package.jsonserver.js → servermain is not defined, defaults to app-V flag, appends the version: server-1.0.0.exe-V flag to include version in the filenameWhen building on Windows, you may see this warning during the injection step:
warning: The signature seems corrupted!
This is completely normal and harmless!
Here's why it happens:
.exe files with a digital signature for securitypostject injects the SEA blob, it modifies the binary structureThe executable will work perfectly fine without the signature. If you want to sign it with a code signing certificate, you can use signtool from the Windows SDK (requires a valid certificate).
⏳ Important: The injection step (step 4/5) can take 30-60 seconds depending on your disk speed.
This is because postject needs to:
This is normal and expected. Just wait for the process to complete. Do not interrupt it during this step!
When you have npm packages in your node_modules, node2exe automatically bundles them into the executable using esbuild. This works great for most packages!
npm install colors
npx node2exe
# This automatically bundles 'colors' into the executable
Some npm packages require external data files (like databases or configuration files). These cannot be automatically bundled into the executable because:
Examples of packages with data files:
geoip-lite - requires .dat files.db filesSolutions:
Use online APIs instead - Replace local data with API calls (recommended) ✅
// Instead of: const geoip = require('geoip-lite');
// Use: fetch('https://ip-api.com/json/' + ip)
Use web services - Move data-heavy operations to cloud services
Manually add assets - Edit sea-config.json to include assets (advanced, complex)
FAQs
Easily convert your Node.js application into an executable with SEA (Single Executable Application)
The npm package node2exe receives a total of 3 weekly downloads. As such, node2exe popularity was classified as not popular.
We found that node2exe demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.