
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
offline-npm
Advanced tools
npm >= v3.x bundled with node >= v5 has broken this project.
preinstallscript is since then called after requests to npm registry are made.
This makes it impossible foroffline-npmto start as a registry server.
See BROKEN.md for detailed logs.
Hassle-free npm pack including all dependencies for offline installation with npm install
Add offline-npm to your project to serve a npm compatible tgz file wich contains all dependencies for offline installation with npm install.
Additionally you can use offline-npm -n to install packages from your local npm cache directory (Could be useful e.g. on travelling).
Even installs using git: or file: (requires node>=0.11) are considered.
npm install -g offline-npm
Open terminal and go to your project you want to prepare for offline use.
This folder needs to contain a package.json file.
Prepare your project for offline use
offline-npm --add
This changes the package.json file and adds a offline folder which will contain all your dependencies.
Pack your project
npm pack
Now the local cache is changed and all your projects dependencies will be downloaded into offline/cache and packed into the npm tgz file.
Note: Take care not to add a global
*.tgzinto your.npmignorefile!
Note: An existing
npm-shrinkwrap.jsonfile will get overwritten in this step to provide install without the--registryswitch. A backup is stored in the./offlinefolder.
Transfer the resulting <name>-<version>.tgz from the pack command onto a machine with no connectivity to the required registry. Execute this line from a terminal.
Now install the package with:
npm install [-g] <name>-<version>.tgz
Find here a step-by-step tutorial using a provided sample project.
If you want to use your local npm cache to install packages from use the option
offline-npm -n [-d]
-dshows you some server logs on the console.
Then install packages from the local npm cache with:
npm --registry http://localhost:4873 [-f] install <packagename>
Use the
-fswitch to force installing packages. This might be required ifnpmstops stating "shasum" errors.
Never add *.tgz into your .npmignore file. Otherwise all package.tgz files for the offline installation will be missing.
If you want to exclude previously packed versions of the package you're working with use <name>-*.tgz instead.
The script needs access to npm. It is assumed that npm is installed alongside with node. If you experience problems with correcty resolving npm, add to your $HOME/.profile or $HOME/.bashrc
export NODE_PATH=<path_to_node_modules>/node_modules:$NODE_PATH
where <path_to_node_modules> is the path to the node_modules dir which contains npm.
If installation hangs try installing in verbose mode
`npm install <name-version>.tgz --verbose`
If you see that some .lock in your files block you from progress, consider deleting them with npm cache clean <pkg>[@<version>]
Copyright (c) 2014 commenthol
Software is released under MIT.
FAQs
npm pack for offline installation
We found that offline-npm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.