
Security News
Feross on the 10 Minutes or Less Podcast: Nobody Reads the Code
Socket CEO Feross Aboukhadijeh joins 10 Minutes or Less, a podcast by Ali Rohde, to discuss the recent surge in open source supply chain attacks.
A wrapper around npm that allows real live git repos to be cloned into node_modules.
npmgitdev a wrapper around npm version 3+ that allows you to work with git repos cloned directly into node_modules.
When we're developing modular software, we often need to edit multiple separate npm packages simultaneously. The "official" way to do this is with npm link. We clone a separate repo for each package, and then link it into the appropriate places. The problem is, npm link creates all sorts of complexities and bugs.
It would be nice if we could avoid all this complexity by simply cloning a repo into node_modules. Unfortunately, npm install will bail (refuse to do anything) when it detects a .git directory inside any package in node_modules.
npmgitdev avoids this problem by:
devDependencies of git packages to dependencies, because you'll probably need them while you're developing your git package..git directory temporarily while invoking an npm command.Installation:
npm install -g npmgitdev
Usage:
# in your project's directory
cd node_modules
git clone https://github.com/TerriaJS/terriajs # or whatever repo you want to work with inside your project
cd ..
# later, or whenever you want:
npmgitdev install
The end result is that npm installs packages exactly as it would if you copied all your devDependencies to dependencies and then published the package to npm. npm's package deduplication actually works, unlike with npm link!
If you accidentally run npm install instead, it should be harmless because npm will bail when it sees your .git directory.
What happens if my git package is referenced from multiple other packages in my dependency tree?
Generally, you should clone your git package into the top-level node_modules directory of your application. Then, npmgitdev will ensure that npm keeps it there by adding a dependency in the top-level package.json to that exact version of the package. If other packages elsewhere in the dependency tree depend on a semver-compatible version of that package, npm 3's deduplication wil avoid installing any other copies of that package elsewhere in the tree.
However, if other packages depend on an incompatible version of that package, or if their dependency is to a Git URL or something else other than a version, npm will install additional copies. If you instead intended for all packages to share the Git repo version of the package, you simply need to delete the extra copies that npm installed. Use npmgitdev list <package name> to see what versions exist in your dependency tree.
FAQs
A wrapper around npm that allows real live git repos to be cloned into node_modules.
The npm package npmgitdev receives a total of 1 weekly downloads. As such, npmgitdev popularity was classified as not popular.
We found that npmgitdev demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Socket CEO Feross Aboukhadijeh joins 10 Minutes or Less, a podcast by Ali Rohde, to discuss the recent surge in open source supply chain attacks.

Research
/Security News
Campaign of 108 extensions harvests identities, steals sessions, and adds backdoors to browsers, all tied to the same C2 infrastructure.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.