Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
package-bundle
Advanced tools
Download npm packages and dependencies as tgz's to then import into package manager or project
package-bundle allows you to download npm packages in their original tar.gz format including their dependencies, and saves them as an archive in the npm folder structure.
Packages can then be imported into a package manager such as Artifactory, and then used in an offline environment.
Download the package using:
npm install -g package-bundle
Or if using yarn
yarn global add package-bundle
You can then use it by running package-bundle
or the alias pb
:
package-bundle request
This command will download "request" and all its dependencies and create an archive package-bundle-.tgz containing all the tgz's required.
You can also download multiple packages by passing in a list:
package-bundle request bluebird
If no packages are entered then it will check for a package.json file, and read in the dependencies.
Usage: package-bundle|pb [packages...] [options]
where <packages> are in the format: [@scope/]<pkg>[@<version>]
If no packages are provided it will check for a package.json
Create a bundle of packages including their dependencies in archive format
Options:
-V, --version output the version number
-d, --no-dev ignore dev dependencies in package.json
-o, --no-optional ignore optional dependencies in package.json
-D, --dev-recursive include all dev dependencies recursively
-O, --optional-recursive include all optional dependencies recursively
-f, --flat save in a flat file structure, instead of individual folders
-z, --no-archive leave dependencies in folder, and don't archive
-x, --no-cache don't use cache file to avoid repeat downloads
-F, --out-file <file> output file name
-a, --all-versions download all versions of specified packages
-A, --all-versions-recursive download all versions of specified packages and dependencies
-c, --concurrency <n> number of requests to make at the same time - default=50
-r, --registry <registry> specify a registry
-p, --proxy <url> proxy url
--basic-auth <hash> Basic auth hash
--auth-token <token> Auth token
--insecure ignore TLS (SSL) certificate errors
-h, --help output usage information
Once you have downloaded the packages you want, you can import the archive into an Artifactory npm repository. To do this, select the deploy option on the repo, and upload the whole archive containing all packages. Select the option to "Deploy as Bundle Artifact", which will keep the folder structure in the archive.
Once this is done, you should now be able to npm install from Artifactory, and it should contain all the dependencies that you just downloaded.
yarn install
yarn start -- --help
To build, run yarn build
;
FAQs
Download npm packages and dependencies as tgz's to then import into package manager or project
The npm package package-bundle receives a total of 13 weekly downloads. As such, package-bundle popularity was classified as not popular.
We found that package-bundle demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.