
Security News
CVE Volume Surges Past 48,000 in 2025 as WordPress Plugin Ecosystem Drives Growth
CVE disclosures hit a record 48,185 in 2025, driven largely by vulnerabilities in third-party WordPress plugins.
A common toolchain for building npm packages written as ES modules.
Inspired by react-scripts. Like that, but for a different set of technology choices.
npm install --save-dev pak-cli
Yarn users, you know what to do instead.
Run npx pak-cli init to get started.
This command will apply the following changes to your package.json:
scripts aliases for the build, docs, lint, test, and test:coverage commands.babel).eslintConfig).main, module, sideEffects, and exports).For more detailed usage information, run npx pak-cli.
Pak is the result of lessons learned and practices adopted in production across hundreds of npm packages I have written, maintained, and/or contributed to over the past several years.
The development process (and CI pipeline) for every npm package can be conceived as, minimally, having the following operations:
Most npm packages differ not in whether the above operations are (or should be) performed, but in how those operations work. Here, package authors must make choices among a wide variety of technologies. For first-time package authors, researching the options can be a daunting and time-consuming task. Even experienced package authors like myself become fatigued at scaffolding a new project, in simply implementing the technologies for which the research has already been done and a decision made.
Many teams and communities have pursued a scaffolding strategy -- where a CLI tool is used to generate the boilerplate for a project which can then be fine-tuned. This works well enough, but the mere presence of boilerplate, or the involvement of code generation at all, is a signal that npm packages are just too complicated to begin with.
Now that modern web browsers and Node.js have a natively supported common dialect for JavaScript code written as ES modules, the era of complicated build toolchains for JavaScript may be finally coming to an end.
Pak embraces this change, and through its technology choices is designed to facilitate the development of new and existing npm packages as native ES modules:
FAQs
A standard way to package, document, lint, and test npm packages.
We found that pak-cli demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
CVE disclosures hit a record 48,185 in 2025, driven largely by vulnerabilities in third-party WordPress plugins.

Security News
Socket CEO Feross Aboukhadijeh joins Insecure Agents to discuss CVE remediation and why supply chain attacks require a different security approach.

Security News
Tailwind Labs laid off 75% of its engineering team after revenue dropped 80%, as LLMs redirect traffic away from documentation where developers discover paid products.