Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
ones-web-common
Advanced tools
这个库存在的意义就是存放一些非高频,相对稳定的通用包;
必要条件
基于 npm7 workspace 维护依赖复用
npm i
采用 npm 自己的发布机制; 可以参考结合 npm-version 或者手动来判定你当前要发哪个版本的包(比如跟迭代来显示差异化)
比如你要给 main-build 发包
# 进入包源码路径
cd packages/main-build
# 安装依赖
npm i
# TODO
#你的变更
# package.json
# 不管是手动还是用npm version来给包名加唯一名字发包用于测试
npm publish
https://our.ones.pro/wiki/#/team/RDjYMhKq/space/DCBqNWkS/page/TFJA7un4
有好的想法都可以实现后提交PR,只要code review和迭代验证没啥问题,就会采纳; 一起添砖加瓦,工具才会越来越好用!
FAQs
The npm package ones-web-common receives a total of 0 weekly downloads. As such, ones-web-common popularity was classified as not popular.
We found that ones-web-common demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.