
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
patch-package
Advanced tools
patch-package lets you easily fix bugs in (or add functionality to) packages in your
node_modules folder and share the results with your team. You simply make the changes in situ,
run patch-package <package-name> and patch-package will create a patch file
for you to commit, which gets applied any time the contents of node_modules is updated by yarn/npm.
yarn add -D patch-package
In package.json
"scripts": {
"prepare": "patch-package"
}
Make changes to the files of a particular module in your node_modules folder, e.g. react-native. Then run:
patch-package react-native
If this is the first
time you've used patch-package, it will create a folder called patches in
the root dir of your app. Inside will be a file called react-native:0.44.0.patch
which is a diff between normal old react-native and your special version. Commit this and you and your team will enjoy the same changes from here on out.
Do exactly the same thing to update the patch file, or just delete it if you don't need the changes anymore.
MIT
Shrinkwrap is a tool for locking down the versions of npm packages installed. It is similar to patch-package in that it helps maintain consistency in dependencies, but it does not allow for modifications to the package code itself.
FAQs
Fix broken node modules with no fuss
The npm package patch-package receives a total of 1,652,338 weekly downloads. As such, patch-package popularity was classified as popular.
We found that patch-package demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.