
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Creates a new node project.
!! Breaking change. Options re-configured.
To quickly initate a project, with complete structure, for testing, developing and/or publishing node modules with or without a public or private git repository. Whew, that was a mouthful!
$ npm install -g npinit
Update your npm config:
npm config set init.author.name "Your Name"
npm config set init.author.url "http://example.com"
npm config set init.author.email "me@example.com"
npm config set init.author.github "your-github-handle"
npm config set init.license "MIT"
npm config set init.version 0.1.0
Usage: npinit <packageName> [options]
npinit <packageName> -dry [options]
npinit -n [options]
npinit -dry [options]
Options:
-h, --help output usage information
-v, --version output the version number
--dry dry run displaying metadata used for generation
-n, --new new private module. for use without a packageName. the default
packageName `testproj###` will be assigned. random number `###`
generated to avoid potential conflicts.
-g, --github new public module. a git repository will be
automactically initialized and pushed to gihub. a packageName
is required. [default mode is private module, no git repo]
running option -n or --new with -g or --github is equivalent to
option `-nr` or `--new --repo` initializing a new private
module with a git repository. packageName will not be required.
options --addRemote, --noRemote and --noPush are inactive in
this mode when `-ng` are run together.
-r, --repo initialize a git repository when generating a private module
[default is none]
--addRemote process will use the generic git command:
`git remote add origin https://github.com/username/repo.git`
username and repo will be automactically added. Leaving this
option off will use `hub` (https://github.com/github/hub)
to createthe remote repository. [default command `hub create`].
You will have to enter your github username and password
if NOT using the --noPush option.
-R, --noRemote do not create a remote repository on github. noRemote
assumes noPush and will override addRemote if both are present.
it will also override the default remote command `hub create`
if addRemote is not present when creating a public module
with flags -g or --github.
-P, --noPush do not push repository to github. use only with
flags -g or --github [default is push]
--D <string> a list of node modules to install, i.e.,
`--D "lodash moment"` or `--D "lodash, moment"`.
[npm i --save packages]
--d <string> a list of node dev modules to install, i.e.,
`--d "tape istanbul"` or `--d "tape, istanbul"`.
[npm i --save-dev devpackages]
Overrides:
--desc <string> description for package.json and github repository if using `hub`.
--author <string> author name for project. [default reads from .npmrc or 'Your Name']
--email <string> email for project. [default reads from .npmrc or 'your@email.com']
--user <string> github username [default reads from .npmrc or 'githubName']
--license <string> license type for project. [default reads from .npmrc => ISC]
--pkgv <string> semantic version for project [default reads from .npmrc => 1.0.0]
npinit --dry # same as npinit -n --dry
# dry run. will display metadata of configured options (private/local module)
npinit -g --dry
# dry run. metadata of public module with git repo initialize
npinit -ng --dry
# dry run private/local module with git repo initalized
npinit -g --noPush
# display help because -g/--github wants a package/project name
npinit test -g
# project named test with repo and pushed to github with command `hub created -d [description]`
npinit test -g --addRemote --noPush
# project named test with repo and remote created to github with https but not pushing to github
npinit test -g --noRemote --D "async lodash coffeescript mout "
# project named test with repo and no remote created.
# dependencies of async, lodash, coffeescript and mout installed.
# same as npinit test -r --D "async lodash coffeescript mout"
npinit test -g --desc "Hello World" --author=me --email "some@body.com" --pkgv "0.4.0" --user=zeke --license "BSD"
# project named test with repo pushed to github with hub create and user overrides
npinit hellotest -r --d "tape istanbul"
# local module/repo, user added devDependencies
initialize. Inspiration of this project. This is my fork, albeit a bloated fork.
create-module. Another awesome project/module creation process which is extremely efficent.
ghrepo. Still another awesome project. Love the code organization and style.
ghwd. For the command line junkies like me.
hub. syntactic sugar for the git command.
argh. light weight option/argv parser for node, it only parses options, nothing more then that.
FAQs
node project init: basic unix style module creation, opinionated defaults
The npm package npinit receives a total of 2 weekly downloads. As such, npinit popularity was classified as not popular.
We found that npinit demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.