verdaccio
artifactory-pypi-scanner
| verdaccio | artifactory-pypi-scanner | |
|---|---|---|
| 8 | 1 | |
| 16,626 | 12 | |
| 0.8% | - | |
| 9.7 | 0.0 | |
| 5 days ago | almost 4 years ago | |
| TypeScript | Go | |
| MIT License | GNU General Public License v3.0 only |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
verdaccio
- verdaccio v5.20.1 has been rolled out
-
3rd party package repositories?
do you know the project https://github.com/verdaccio/verdaccio
-
📦 Everything you need to know: package managers
Verdaccio allows to setup a private proxy registry for Node.js
-
Npm link doesn't work with React Native, what do you use for testing local modules?
Verdaccio does okay for this
-
Hosting my own node_modules
There’s also this: https://www.npmjs.com/package/verdaccio
-
Self-Hosted Private Registry
Cool! What makes Package Depot better than existing solutions such as verdaccio?
-
Monorepo or not?
I highly recommend using a package proxy like https://github.com/verdaccio/verdaccio instead of git submodules if you have more then one developer using your code/repo. Biggest factor is the cost of the developers time. Why teach them a different way to install dependancies when there is a standard way of doing things your CI/CD is simplified, the knowledge of git submodules is good to know, but this is now tribal knowledge on how to setup this up, update dependancies, etc...
-
Researcher hacks over 35 tech firms in novel supply chain attack
The goal of verdaccio is to make this less complicated. https://github.com/verdaccio/verdaccio
artifactory-pypi-scanner
-
Researcher hacks over 35 tech firms in novel supply chain attack
To mitigate this kind of supply chain attacks for python, we have created following tool [1], that will check python packages on Artifactory instance you specify and create packages with the same name on the PyPi.
[1] https://github.com/pan-net-security/artifactory-pypi-scanner
What are some alternatives?
rubygems - Library packaging and distribution for Ruby.
SES-shim - Endo is a distributed secure JavaScript sandbox, based on SES
dawson-cli - A serverless web framework for Node.js on AWS (CloudFormation, CloudFront, API Gateway, Lambda)
nixpkgs - Nix Packages collection & NixOS
yalc - Work with yarn/npm packages locally like a boss.
pip - The Python package installer
AWS Lambda Router for NodeJS - AWS Lambda router for NodeJS
Nodemailer - ✉️ Send e-mails with Node.JS – easy as cake!
Perk - A well documented set of tools for building node web applications.
linux - Kernel source tree for Raspberry Pi-provided kernel builds. Issues unrelated to the linux kernel should be posted on the community forum at https://forums.raspberrypi.com/
registry-sync - synchronize selected packages from a remote npm registry