
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
The Moddable SDK and associated dev board tooling is incredibly empowering for embedded JS hardware development, however the set up process can be tedious to follow when getting started. This project aims to streamline the install and environment configuration requirements across platforms in just a few commands.
This project is a continual work in progress and v1, so breaking changes will be semantically-released with major version bumps.
Node.js, at least the active LTS version.
If you've never installed Node.js before, check out the getting started guide for xs-dev.
XZ utils are required to install the CLI due to a dependency for decompressing the ARM toolchain used for nrf52 development.
It can be installed with Homebrew on MacOS:
brew install xz
Or as xz-utils on Linux distributions like Ubunutu:
apt-get install xz-utils
On Linux:
Setup commands rely on ssh-askpass to prompt for permission when installing other tools and dependencies.
npm install -g xs-dev
pnpm install -g xs-dev
yarn global add xs-dev
npm update -g xs-dev
pnpm update -g xs-dev
yarn global upgrade xs-dev
Check out the docs to learn about using xs-dev and getting started with embedded JS development.
Clone the project and install dependencies. We're using pnpm and volta to manage packages and Node.
git clone https://github.com/HipsterBrown/xs-dev.git
cd xs-dev
pnpm install
Link dev version of CLI using pnpm, which will override any other globally installed version:
pnpm link --global
pnpm link --global xs-dev
Or create an alias to clearly denote the local version of the CLI:
alias local-xs-dev=$PWD/bin/xs-dev
To maintain the alias between shell sessions, for example I use zsh:
echo "alias local-xs-dev=$PWD/bin/xs-dev" >> ~/.zshrc
The documentation site is built with Astro with the Starlight template and can be found in the docs/ directory. When working on them locally, run pnpm start:docs to start the development server that watches for file changes and reloads the page.
Inside of your Astro + Starlight project, you'll see the following folders and files:
.
├── public/
├── src/
│ ├── assets/
│ ├── content/
│ │ ├── docs/
│ │ └── config.ts
│ └── env.d.ts
├── astro.config.mjs
├── package.json
└── tsconfig.json
Starlight looks for .md or .mdx files in the src/content/docs/ directory. Each file is exposed as a route based on its file name.
Images can be added to src/assets/ and embedded in Markdown with a relative link.
Static assets, like favicons, can be placed in the public/ directory.
Thanks goes to these wonderful people (emoji key):
Nick Hehr 📖 🚇 💻 ⚠️ | Andy Carle 💻 | Peter Hoddie 💻 | Satoshi Tanaka 💻 | Andréas Hanss 📖 | Gustavo 💻 | Richard Gibson 📖 |
Jay Kesarkar 💻 | Gustavo Gallegos 📖 | Donovan Buck 💻 | Michael Kellner 💻 | Dane Henson 💻 | Ayachika Kitazaki 💻 | Andrew Chou 💻 |
This project follows the all-contributors specification. Contributions of any kind welcome!
FAQs
CLI for automating the setup and usage of Moddable XS tools
We found that xs-dev demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.