
Research
/Security News
Toptal’s GitHub Organization Hijacked: 10 Malicious Packages Published
Threat actors hijacked Toptal’s GitHub org, publishing npm packages with malicious payloads that steal tokens and attempt to wipe victim systems.
npm-linkdependencies
Advanced tools
Branch | build status |
---|---|
Master | |
Development |
In some projects, there are multiple npm packages developed simultaneously and are dependant on each other. The problem is how to develop and test these. Some options are:
npm install
npm package
and then install from local
The best option would be that the information on which packages need to be linked would not leave the package space (not even with monorepo) to keep the information in proper context and in one place. Whatever the solution is, it should also take the production deployment/environment into account and use published packages there.
What does it do (or when I'm writing this: what will it do) then?
This module adds support for a new field in package.json
: linkDependencies. This field is an subobject which works as
a configuration for npm-linkDependencies package. With it the developer can list what packages must linked and takes care
of rollback if the linking fails. It checks whether the packages are already installed and skips those. Since some
dependencies can be peerDependencies, it also can install those before doing the linking. This way the package developer
can safely use npm-linkDepencies as post install step without breaking things in deployment/production, removes the
need for external tools and information and with post install removes an extra step after npm install
.
By defining the dependencies
as an object where key is the package name and value the relative path to it, the
script also takes care of running npm link
in the package to be linked.
package.json:
{
"name": "example-package",
...snip...
"linkDependencies": {
"installPeerDependencies": false,
"createLink": false,
"fallbackToInstall: false,
"autoOverrideLink": false,
"environmentKey": "ENVIRONMENT",
"skipInEnvironments": [
...list of environments...
]
"dependencies": [...list of package names] or { object with relative paths }
}
...snip...
}
createLink
set to true
, the script will attempt to create a symbolic link to global packages. If the symlink already
exists in global node modules, then this property is checked whether it should be overwritten automatically. At the moment
when autoOverrideLink
is set to false
, the link will not be overwritten/recreated. In the future this will be changed so that
user interaction will be required if set to false
: (default: false)npm link
has been done for the package first and that the it is not installed
globally from the public registry, but is a symbolic link. If fallbackToInstall
is set to true
, then object format should
be used where the key is the link name and value is the fallback package with possible version. For example, if the dependencies
are { "mylocalpkg": "lodash" }
, the script first checks if it can run npm link mylocalpkg
and if not, then it runs
npm install --no-save lodash
as a fallback option.environmentKey
. (default: empty){
"name": "example-package",
"version": "0.0.1",
"description": "example-package",
"main": " ",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"author": "Tomi Teekkari",
"license": "MIT",
"linkDependencies": {
"fallbackToInstall": true,
"createLink": true,
"installPeerDependencies": true,
"autoOverrideLink": true,
"environmentKey": "MY_ENV",
"skipInEnvironments": [
"STAGING", "PRODUCTION", "TESTING"
]
"dependencies": {
"my-first-dependency": "my-first-dependency@1.2.3",
"my-second-dependency": "my-second-dependency"
}
},
"dependencies": {
"lodash": "4.12.3"
},
"devDependencies": {
"jasmine": "*"
}
}
npm-linkDependencies has been tested to work with NodeJS 6.x to 10.x in Linux and OSX environments using Travis CI. It has also been tested on Windows 10 (in Powershell and Git Bash) and the tests pass. However, Windows testing has not been automated. Travis CI now has windows platform support (released ~2018-10-11), but the tests do not run there properly and time out.
The tests are end-to-end tests that use dummy packages and are currently executed in the default environment. This means that
new links will be created and at the end of the tests the links will be removed with npm rm --global <pkg>
.
Tests can be executed with npm test
after npm install
and use default Jasmine BDD test framework.
FAQs
Tool to help with npm package development
The npm package npm-linkdependencies receives a total of 0 weekly downloads. As such, npm-linkdependencies popularity was classified as not popular.
We found that npm-linkdependencies demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Threat actors hijacked Toptal’s GitHub org, publishing npm packages with malicious payloads that steal tokens and attempt to wipe victim systems.
Research
/Security News
Socket researchers investigate 4 malicious npm and PyPI packages with 56,000+ downloads that install surveillance malware.
Security News
The ongoing npm phishing campaign escalates as attackers hijack the popular 'is' package, embedding malware in multiple versions.