corepack
verdaccio
Our great sponsors
corepack | verdaccio | |
---|---|---|
5 | 8 | |
2,136 | 15,864 | |
5.5% | 0.9% | |
8.7 | 9.7 | |
4 days ago | 1 day ago | |
TypeScript | TypeScript | |
MIT License | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
corepack
-
Yarn 4.0
I'd love to use Bun for my projects, but it's not integrated into Corepack yet (and therefore you cannot pin the bun version w/ checksum in package.json)
https://github.com/nodejs/corepack/issues/295
- corepack global package?
-
Every NPM package potentially compromised
Recently Node 16 LTS cycle started. One month and a few days before the carry-over, a super controversial package titled `coredeps` [0] was officially declared a core module and has been bundled with all official distributions since.
The NodeJS team refuses to discuss NPM because it's a separate 3rd party. And yet.... this NodeJS Core module comes pre-installed as a global NPM package.
We're just getting started.
This module installs or even reinstalls any supported package manager when you execute a script with a name that would match any that they'd recognise. Opt-in for only a short period, and intending to expand beyond package manager installations.
Amidst all that's been going on, NPM (Nonstop Published Moments) is working on a feature that silently hijacks user commands and installs foreign software. The code found in those compromised packages operated in a similar manner and was labeled a critical severity vulnerability.
The following might actually make you cry.
Of these third party remote distributions it's downloading, the number of checksum, keys, or even build configurations that are being verified is 0.
The game that Microsoft is playing with their recent acquisitions here is quite clear, but there's too much collateral damage.
[0] https://github.com/nodejs/corepack#readme
-
Corepack: the Node.js' manager of package managers
The new Node.js LTS v16 will be released at the end of October (without a fancy name assigned yet), it'll have Corepack preinstalled in the default configuration since v16.9.0. π
-
Yarn 3.0 ππ€ Performances, ESBuild, Better Patches, ...
Corepack integration
verdaccio
- verdaccio v5.20.1 has been rolled out
-
3rd party package repositories?
do you know the project https://github.com/verdaccio/verdaccio
-
π¦ Everything you need to know: package managers
Verdaccio allows to setup a private proxy registry for Node.js
-
Npm link doesn't work with React Native, what do you use for testing local modules?
Verdaccio does okay for this
-
Hosting my own node_modules
Thereβs also this: https://www.npmjs.com/package/verdaccio
-
Self-Hosted Private Registry
Cool! What makes Package Depot better than existing solutions such as verdaccio?
-
Monorepo or not?
I highly recommend using a package proxy like https://github.com/verdaccio/verdaccio instead of git submodules if you have more then one developer using your code/repo. Biggest factor is the cost of the developers time. Why teach them a different way to install dependancies when there is a standard way of doing things your CI/CD is simplified, the knowledge of git submodules is good to know, but this is now tribal knowledge on how to setup this up, update dependancies, etc...
-
Researcher hacks over 35 tech firms in novel supply chain attack
The goal of verdaccio is to make this less complicated. https://github.com/verdaccio/verdaccio
What are some alternatives?
nvm - Node Version Manager - POSIX-compliant bash script to manage multiple active node.js versions
yalc - Work with yarn/npm packages locally like a boss.
npm
registry-sync - synchronize selected packages from a remote npm registry
asdf - Extendable version manager with support for Ruby, Node.js, Elixir, Erlang & more
AWS Lambda Router for NodeJS - AWS Lambda router for NodeJS
vscode-deploy-reloaded - Recoded version of Visual Studio Code extension 'vs-deploy', which provides commands to deploy files to one or more destinations.
artifactory-pypi-scanner - Saves you from package injection!
berry - π¦π Active development trunk for Yarn β
Express - Fast, unopinionated, minimalist web framework for node.
node - Node.js JavaScript runtime β¨π’πβ¨
Moleculer - :rocket: Progressive microservices framework for Node.js