
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Zembil (Amharic for "stash" or "store") is an offline package and documentation cache system designed for developers in areas with unreliable internet connectivity and frequent power outages.
Developers in regions with poor internet infrastructure face:
npm install attemptsZembil allows developers to:
# Install Zembil
npm install -g zembil
# Initialize cache directory
zembil init
# Initialize with custom cache directory (optional)
zembil --cache-dir ./my-cache init
# Queue packages for download
zembil queue add react -v 18.2.0
zembil queue add express -v 4.18.0
zembil queue add lodash -v 4.17.21
# Download queued packages (when you have good internet)
zembil sync
# ⬇️ react@18.2.0: [████████░░░░░░░░░░░░] 45% (2.3MB / 5.1MB)
# If interrupted (network loss, Ctrl+C), progress is automatically saved!
# Check status anytime:
zembil queue list
# ⏸️ react@18.2.0 (npm) - interrupted
# Progress: [████████░░░░░░░░░░░░] 45% (2.3MB / 5.1MB) (interrupted, will resume)
# Resume when ready (just run sync again, or use resume command)
zembil queue resume # Optional: marks interrupted items for retry
zembil sync # Continues from where it left off
# Cancel downloads if needed
zembil queue cancel react # Cancel specific package
zembil queue cancel-all # Cancel all pending downloads
# Manage cache
zembil cache clean react # Remove all versions of a package
zembil cache clean --all # Remove all cached packages
zembil cache cleanup # Clean orphaned files
# Install from cache (works offline!)
zembil install react express lodash
import { Zembil } from 'zembil';
// Initialize Zembil
const zembil = new Zembil('./cache');
await zembil.initialize();
// Queue packages
await zembil.queue.add('react', '18.2.0', 'npm', 10);
await zembil.queue.add('express', '4.18.0', 'npm', 8);
// Download packages (progress tracked automatically)
await zembil.sync();
// If interrupted (network error, Ctrl+C), progress is automatically saved!
// Check status to see what was interrupted
const status = await zembil.queue.getStatus();
const items = await zembil.queue.list();
items.forEach(item => {
if (item.progress) {
console.log(`${item.packageName}: ${item.progress.percentage}% (interrupted, will resume)`);
}
});
// Resume interrupted downloads (optional - sync will also retry them)
await zembil.queue.resume();
await zembil.sync(); // Continues from where it left off
// Install from cache
await zembil.install('react', './node_modules');
┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐
│ Good Internet │ │ Local Cache │ │ Offline Usage │
│ │ │ │ │ │
│ • Queue packages│───▶│ • Package files │───▶│ • Instant install│
│ • Download docs │ │ • Documentation │ │ • Fast docs │
│ • Sync metadata │ │ • Examples │ │ • No latency │
└─────────────────┘ └─────────────────┘ └─────────────────┘
npm install -g zembil
npm install zembil
MIT License - Built for the global developer community
FAQs
Offline Package & Docs Cache for developers with unreliable internet
We found that zembil demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.