Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
prebuild-install
Advanced tools
A command line tool to easily install prebuilt binaries for multiple version of node/iojs on a specific platform
The prebuild-install npm package is used to install prebuilt binaries for Node.js modules, if available, before falling back to building from source. This can significantly speed up installation times and avoid the need for a full development environment with build tools like gcc or Visual Studio.
Installing prebuilt binaries
Automatically downloads and installs prebuilt binaries for a module if they are available for the current platform and Node.js version. If prebuilt binaries are not available, it will fall back to building from source.
npm install --save <module-name>
Custom binary hosting
Allows specifying custom hosting URLs and tag prefixes for prebuilt binaries, enabling the use of private or alternative binary hosting solutions.
npm install --build-from-source --prebuild-tag-prefix="<custom-prefix>-" --prebuild-download="<custom-hosting-url>"
Skipping prebuilt binary download
Forces the installation process to compile the module from source, bypassing the download of prebuilt binaries.
npm install --build-from-source
node-pre-gyp is a similar package that facilitates the installation of precompiled binaries for Node.js modules. It differs from prebuild-install in its configuration and build process, but serves a similar purpose of avoiding the need to compile modules from source.
node-gyp is not a direct alternative to prebuild-install but is often used in conjunction with it. node-gyp is a cross-platform command-line tool for compiling Node.js native addon modules from source. It is used when prebuilt binaries are not available or when a build from source is explicitly requested.
prebuild is a tool for creating and managing prebuilt binaries for Node.js modules. It is often used in tandem with prebuild-install. While prebuild is focused on the creation of the binaries, prebuild-install is designed for the end-user installation experience.
A command line tool to easily install prebuilt binaries for multiple version of node/iojs on a specific platform.
prebuild-install
supports installing prebuilt binaries from GitHub by default.
Change your package.json install script to:
{
"scripts": {
"install": "prebuild-install || node-gyp rebuild"
}
}
You need to provide prebuilds made by prebuild
.
prebuild-install [options]
--download -d [url] (download prebuilds, no url means github)
--target -t version (version to install for)
--runtime -r runtime (Node runtime [node, napi or electron] to build or install for, default is node)
--path -p path (make a prebuild-install here)
--token -T gh-token (github token for private repos)
--tag-prefix <prefix> (github tag prefix, default is "v")
--build-from-source (skip prebuild download)
--verbose (log verbosely)
--libc (use provided libc rather than system default)
--debug (set Debug or Release configuration)
--version (print prebuild-install version and exit)
When prebuild-install
is run via an npm
script, options
--build-from-source
, --debug
and --download
, may be passed through via
arguments given to the npm
command.
prebuild-install
supports downloading prebuilds from private GitHub repositories using the -T <github-token>
:
$ prebuild-install -T <github-token>
If you don't want to use the token on cli you can put it in ~/.prebuild-installrc
:
token=<github-token>
Alternatively you can specify it in the prebuild-install_token
environment variable.
Note that using a GitHub token uses the API to resolve the correct release meaning that you are subject to the (GitHub Rate Limit).
To create a token:
Generate new token
buttonGenerate token
button, see belowThe default scopes should be fine.
The end user can override binary download location through environment variables in their .npmrc file.
The variable needs to meet the mask % your package name %_binary_host
or % your package name %_binary_host_mirror
. For example:
leveldown_binary_host=http://overriden-host.com/overriden-path
Note that the package version subpath and file name will still be appended.
So if you are installing leveldown@1.2.3
the resulting url will be:
http://overriden-host.com/overriden-path/v1.2.3/leveldown-v1.2.3-node-v57-win32-x64.tar.gz
All prebuilt binaries are cached to minimize traffic. So first prebuild-install
picks binaries from the cache and if no binary could be found, it will be downloaded. Depending on the environment, the cache folder is determined in the following order:
${npm_config_cache}/_prebuilds
${APP_DATA}/npm-cache/_prebuilds
${HOME}/.npm/_prebuilds
MIT
FAQs
A command line tool to easily install prebuilt binaries for multiple version of node/iojs on a specific platform
We found that prebuild-install demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.