
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
[!WARNING] This project is not actively maintained anymore. Please consider using tsdown instead. Read more in the migration guide.
Bundle your TypeScript library with no config, powered by esbuild.
Anything that's supported by Node.js natively, namely .js, .json, .mjs. And TypeScript .ts, .tsx. CSS support is experimental.
Install it locally in your project folder:
npm i tsup -D
# Or Yarn
yarn add tsup --dev
# Or pnpm
pnpm add tsup -D
You can also install it globally but it's not recommended.
tsup [...files]
Files are written into ./dist.
You can bundle multiple files in one go:
tsup src/index.ts src/cli.ts
This will output dist/index.js and dist/cli.js.
For complete usages, please dive into the docs.
For all configuration options, please see the API docs.
Head over to the discussions to share your ideas.
MIT © EGOIST
Esbuild is an extremely fast JavaScript bundler and minifier. It is known for its speed and efficiency, making it a popular choice for large projects. Compared to tsup, esbuild offers more advanced features but may require more configuration.
Rollup is a module bundler for JavaScript that compiles small pieces of code into something larger and more complex, such as a library or application. It is highly configurable and supports a wide range of plugins. Rollup is more flexible but can be more complex to set up compared to tsup.
Webpack is a powerful and highly configurable module bundler for JavaScript applications. It supports a wide range of features and plugins, making it suitable for complex projects. However, it can be more challenging to configure and may require more boilerplate compared to tsup.
FAQs
Bundle your TypeScript library with no config, powered by esbuild
The npm package tsup receives a total of 2,173,684 weekly downloads. As such, tsup popularity was classified as popular.
We found that tsup demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.