npm-lint
pnpm
npm-lint | pnpm | |
---|---|---|
4 | 96 | |
26 | 27,802 | |
- | 1.6% | |
0.0 | 9.8 | |
about 4 years ago | 5 days ago | |
TypeScript | TypeScript | |
MIT License | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
npm-lint
-
JavaScript registry NPM vulnerable to 'manifest confusion' abuse
That postinstall and other scripts have been a problem for a long time - the PoC for example could be installed via npx, which would then run postinstall which executes another script to steal /etc/password data.
This is not a new problem, you just have another vector.
I came up with a free linter package to try solve it - but no one seemed interested, and here we are 7 later talking about where people are now offering paid services to mitigate it.
https://github.com/tanepiper/npm-lint
-
Dissecting Npm Malware: Five Packages And Their Evil Install Scripts
Also ended up writing a similar tool but didn't take it much further.
-
npm package to upload your private ssh keys to a pastebin
I did try come up with a npm linter but never really completed it.
-
Getting rid of NPM scripts
A while back I wrote a opt-in tool called npl-lint[1] that would allow some CI-level enforcement of rules in package.json although I didn't go too far with it - one thing was to check the scripts section and allow whitelisted apps, or whitelisted sources for dependencies.
It came about because I ended up having a spat with one of the NPM engineers at the time because they launched npx with the ability to run arbitrary gists[2] and this was before 2FA (FWIW you can still absolutely do this with npx).
I wrote a proof of concept[3] that showed you could, inside a package.json add a command to install another package from a gist location, and then use that to steal credentials, bash history, etc.
[1] https://github.com/tanepiper/npm-lint
pnpm
-
Node package managers (npm, yarn, pnpm) - All you need to know
pnpm
-
Letβs build AI-tools with the help of AI and Typescript!
Pnpm for install Javascript/Typescript packages, like LangChain.js
- Pnpm 9
-
Understanding Dependencies in Programming
Node.js manages dependencies using package managers like npm (Node Package Manager), yarn, and pnpm. npm comes pre-installed with Node.js and allows you to install and uninstall Node.js packages. It uses a package.json file to keep track of which packages your project depends on. Yarn and Pnpm are alternative package managers that aim to improve on npm in various ways, such as improved performance and better lock file format.
-
Manage project dependencies correctly
Use pnpm - This is just one recommendation, but it's too big of a topic to discuss here.
- Bun 1.1
-
Using pnpm with the GitLab package registry in GitLab CI
In this blog post, I explain how to use pnpm in GitLab CI and how to authenticate with a private GitLab package registry.
-
Unit Testing in Node.js and TypeScript: A Comprehensive Guide with Jest Integration
A package manager such as npm, Yarn, or pnpm. A package manager is a tool that helps you manage the dependencies of your project. You can use any of these package managers to install Jest and other packages.
-
Understanding Redux: A Practical Guide to State Management
Installation: Install Redux and React-Redux using npm or yarn.(you can try pnpm too!)
-
Effective nodejs version management for the busy developer
I also recommend using pnpm as a package manager, it's faster and more efficient than npm or yarn with great capabilities concerning monorepo setup. On recent nodejs versions (v16.13+), you can install it easily with:
What are some alternatives?
ultra-runner - πβ° Ultra fast monorepo script runner and build tool
nx - Smart Monorepos Β· Fast CI
steal-ur-stuff - Steal Ur Stuff
lerna - :dragon: Lerna is a fast, modern build system for managing and publishing multiple JavaScript/TypeScript packages from the same repository.
actual-malware - Useful library dependency
berry - π¦π Active development trunk for Yarn β
yarn - The 1.x line is frozen - features and bugfixes now happen on https://github.com/yarnpkg/berry
deno - A modern runtime for JavaScript and TypeScript.
npm
Bower - A package manager for the web
npm-check-updates - Find newer versions of package dependencies than what your package.json allows
DeepCreamPy