Our plan for a more secure npm supply chain
Open source software is the bedrock of the modern software industry. Its collaborative nature and vast ecosystem empower developers worldwide, driving efficiency and progress at an unprecedented scale. This scale also presents unique vulnerabilities that are continually tested and under attack by malicious actors, making the security of open source a critical concern for all. Transparency is centr
SSH keys stolen by stream of malicious PyPI and npm packages
A stream of malicious npm and PyPi packages have been found stealing a wide range of sensitive data from software developers on the platforms. The campaign started on September 12, 2023, and was first discovered by Sonatype, whose analysts unearthed 14 malicious packages on npm. Phylum reports that after a brief operational hiatus on September 16 and 17, the attack has resumed and expanded to the
npmのprivate registryからGitHub Packages Registryに移行する
PLAIDでは社内のNode.jsパッケージの管理にnpm private registry(npmのregistryにprivateでパッケージをpublishする形式)を利用していました。 また、npm private registryを導入する以前の古いパッケージは、GitHubのプライベートリポジトリのURLをpackage.jsonに指定しているパッケージも混在していました。 その中で、2019年5月にGitHub Packages Registryがベータ公開されました。 Introducing GitHub Package Registry - The GitHub Blog GitHubアカウントとの統合性、GitHubリポジトリとGitHub Actionsでの連携を考えて、 社内パッケージをGitHub Packages Registryへ移行することにしました。 移行
semver 日本語版
本ページは npm.org 提供文書を翻訳したものです。 原文は 本家参照 、誤謬・誤記の指摘は こちら からお願いします。 × npm 用 有意バージョン生成装置 使い方 $ npm install semver semver.valid('1.2.3') // '1.2.3' semver.valid('a.b.c') // null semver.clean(' =v1.2.3 ') // '1.2.3' semver.satisfies('1.2.3', '1.x || >=2.5.0 || 5.0.0 - 7.2.3') // true semver.gt('1.2.3', '9.8.7') // false semver.lt('1.2.3', '9.8.7') // true コマンドラインからの利用: $ semver -h semver <version> [<versi
npm is joining GitHub
AI & MLLearn about artificial intelligence and machine learning across the GitHub ecosystem and the wider industry. Generative AILearn how to build with generative AI. GitHub CopilotChange how you work with GitHub Copilot. LLMsEverything developers need to know about LLMs. Machine learningMachine learning tips, tricks, and best practices. How AI code generation worksExplore the capabilities and be
npm trends: Compare NPM package downloads
Sick of boring JavaScript newsletters?Bytes is a JavaScript newsletter you'll actually enjoy reading. Delivered every Monday, for free.
How to Use npm as a Build Tool
Update: I frequently get asked, considering this post is now years old, whether or not I still stand by the advice in this post, and whether new developers should use npm as a build tool. The advice still stands, and I believe developers should use npm as a build tool. Myself; I've been Gulp & Grunt free since 2013™. Should I ever change my stance on this, I will immediately update this post. Last
YARN vs NPM (vs pnpm) in 2019: comparison and verdict
YARN vs NPM (vs pnpm) in 2019: comparison and verdict A comparative analysis of the most used package managers for JavaScript and Node.js and what to use in 2019 In this article I'll talk about Yarn and NPM, arguably the most popular JavaScript package managers available as of today, with the precise intent of compare their respective features and explain what I'm (mostly) using nowadays and why:
eslint4b
ESLint which works in browsers. 🏁 Goal ESLint doesn't support browsers officially, but we can use it similar to the official online demo. This package provides the Linter class which is modified to work in browsers. Eliminate the dependency to fs. Eliminate the dynamic require()s. This package is kept latest with cron jobs GitHub Actions provide. 💿 Installation Use npm to install. npm install es
chrome-launcher
Launch Google Chrome with ease from node. Disables many Chrome services that add noise to automated scenarios Opens up the browser's remote-debugging-port on an available port Automagically locates a Chrome binary to launch Uses a fresh Chrome profile for each launch, and cleans itself up on kill() Binds Ctrl-C (by default) to terminate the Chrome process Exposes a small set of options for configu
compass-mixins
Status This library is not maintained anymore. Compass SASS Stylesheets This is a repository to pull SASS style sheets on Bower, and enjoy the compass mixins by using libsass for faster compilation. This project makes minimal modifications to the original Compass 0.12.X stylesheets from the original repository, intented to improve libsass compatibility and not change output. Compass Ruby Functions
babel-preset-typescript
babel-preset-typescript Babel preset for TypeScript. This preset includes the following plugins: transform-typescript syntax-object-rest-spread Example In
npm ciを使おう あるいはより速く - Qiita
人類はより高速にCIを回していくべきだと思っている りんご（@mstssk）です。 先日、 npm の v5.7がリリースされ npm ci というサブコマンドが新たに追加されました。 The npm Blog — Introducing npm ci for faster, more reliable... http://blog.npmjs.org/post/171556855892/introducing-npm-ci-for-faster-more-reliable CI/CDを開発プロセスに組み込んでいる場合により整合性があり高速なエクスペリエンスを提供する、と公式ブログでは紹介しています。 npm ci は何をするのか npm ci を実行すると常に package-lock.json から依存関係をインストールします。 既に node_modules フォルダの中身があっても
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
react-native-yubinbango
package-lock.json | npm Docs
Pre and Post hooks for npm scripting
ホーム - CloneTracker
会計freee が yarn から npm に出戻った本当の理由
npm トラブルシューティング - Qiita
npm
