How we built JSR
We recently launched the JavaScript Registry - JSR. It’s a new registry for JavaScript and TypeScript designed to offer a significantly better experience than npm for both package authors and users: It natively supports publishing TypeScript source code, which is used to auto-generate documentation for your package It’s secure-by-default, supporting token-less publishing from GitHub Actions and pa
Introducing our team, investors & more...
Last year, after incorporating vlt technology Inc., I began the search for key venture partners & founding team members. Today, I'm thrilled to unveil the exceptional people comprising our core team & the distinguished investors who share our bold vision. Our TeamWe're putting the band back together (left-to-right) Isaac Z. Schlueter: creator of npm, former CEO of npm Inc. & Principal Engineer at
Why Should You Care About Package Metadata Interoperability? | OpenJS Foundation
Community Why Should You Care About Package Metadata Interoperability? A neutral industry group called the Package Metadata Interoperability Collab Space has formed at the OpenJS Foundation to iterate on the informal standardization of package.json and improve the interoperability of JavaScript package metadata for application developers. The package.json file is the entry point for nearly all Jav
Node.js Community Debate Intensifies Over Enabling Corepack by Default and Potentially Unbundling npm - Socket
Node.js Community Debate Intensifies Over Enabling Corepack by Default and Potentially Unbundling npmThe Node community is wrestling with the decision to enable Corepack by default, which has sparked a debate about the potential of removing npm from the Node.js binary. A heated debate is happening in the Node.js community over a proposal to enable Corepack by default that was opened in November 20
Node.jsで機能やパッケージの非推奨メッセージを通知する方法
ライブラリやツールなどを作っているときに、特定の機能やパッケージを非推奨にする場合があります。 これらの非推奨はリポジトリ上のREADMEやIssueなどに書いても、利用者が気づかないことがあります。 そのため、利用者が気付けるように非推奨の機能やパッケージを使った場合に警告を出す方法を紹介します。 非推奨にはいくつかの段階があり、それに応じてやり方を変えられるので、それぞれの方法を紹介します。 パッケージの非推奨化: npm deprecate <package> <message> コードレベルの非推奨化: JSDocタグの@deprecated 実行時の非推奨化: process.emitWarning() パッケージの非推奨化: npm deprecate <package> <message> npmのパッケージレベルで、そのパッケージが非推奨であることを通知するにはnpm de
Malicious npm Packages Used to Target GitHub Developer SSH Keys
Malicious npm Packages Used to Target GitHub Developer SSH Keys Security researchers have uncovered two new malicious packages on the npm open source package manager that utilized GitHub to store stolen Base64-encrypted SSH keys taken from developer systems. These packages, identified earlier this month, have since been removed from npm. According to a ReversingLabs report published today, this di
npm in Review: A 2023 Retrospective on Growth, Security, and Quirky Facts - Socket
npm in Review: A 2023 Retrospective on Growth, Security, and Quirky FactsFrom unprecedented expansion to security challenges: A comprehensive look at npm's dynamic year. It's a new year! So let's look back at how npm, the most popular package manager in the world, fared in 2023. We will look at some of the major trends in the ecosystem and investigate what the data reveal about how npm grew over t
The package that broke NPM (accidentally) - uncenter.dev
An update! You might want to read the rest of the article first... GitHub has now, a day after writing this, fully "disabled" (whatever that means) our everything-registry organization on NPM and GitHub; you can see the email they sent to me below. While I may not agree entirely with the reasoning they provided, I am very thankful that our personal accounts are still intact! Email from GitHub Trus
NPM registry prank leaves developers unable to unpublish packages
NPM registry prank leaves developers unable to unpublish packagesLaura FrenchJanuary 3, 2024 A prank on npm included a meme image of Gary Oldman from the film “Léon." (Photo by Patrick Camboulive / Sygma via Getty Images) Update Jan. 4, 2024: GitHub told SC Media Wednesday night that disruptions related to the "everything" package, and its registry-wide dependencies, were being resolved. "We found
TS Docs | Reference docs for npm packages
tsdocs.dev helps you browse reference typescript documentation for any package or version of a library. Made with the help of typedoc
npm install --productionみたいなの色々ありすぎ問題
本記事で使用するnpmはv10.2.3です。これは記事投稿時点で最新のnode.jsのLTSにバンドルされているものですが、これを採用しているプロジェクトはまだ少ないはずです。 そのため、本記事の一部のオプションは動作しない可能性があります。適宜お手元のバージョンのドキュメントを覗いたり、動作確認を実施した上でご利用ください。 実行環境とマシンの情報 $ node -v v20.10.0 $ npm -v 10.2.3 $ system_profiler SPHardwareDataType | grep -E 'Model Name|Chip' Model Name: MacBook Air Chip: Apple M2 $ sw_vers ProductName: macOS ProductVersion: 14.1.1 BuildVersion: 23B81 調べたこと packag
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
pnpm: support needed for its new v9 lockfile format · Issue #9522 · dependabot/dependabot-core
cli: implement `node --run <script-in-package-json>` by anonrig · Pull Request #52190 · nodejs/node
NpmBurst
Japan Blames North Korea for PyPI Supply Chain Cyberattack
GitHub - pkg-tools/pkg-tools: An opinionated build toolchain with typed configuration. A project by @dopt.
GitHub - nice-registry/all-the-package-names: 🔤 A list of all the public package names on npm. Updated daily.
enable corepack by default · Issue #50963 · nodejs/node
https://twitter.com/npm_malware
GitHub - isaacs/sock-daemon