npmpackage.info

An interesting fact about npm is that it started as a weekend project by its creator, Isaac Z. Schlueter, in 2009. It was officially launched in January 2010.

@vercel/ncc

Compile a Node.js project into a single file. Supports TypeScript, binary addons, dynamic requires.

0.38.1

9,098

MIT

JavaScript

631.00 B

50,955,629

4.8

Installations

npm install @vercel/ncc

Score

76.6

Supply Chain Risk

98.4

Quality

83.6

Maintenance

100

Vulnerability

Pull Requests

Open

30

Total

643

Closed

183

Merged

430

Issues

Open

189

Total

556

Closed

367

Releases

0.38.1

Published on 18 Oct 2023

0.38.0

Published on 06 Sept 2023

0.37.0

Published on 06 Sept 2023

0.36.1

Published on 25 Jan 2023

0.36.0

Published on 05 Dec 2022

0.35.0

Published on 25 Jan 2023

View all 84 releases

Contributors

123

View all 123 contributors

Developer

vercel

Statistics

9,098 Stars

587 Commits

288 Forks

92 Watching

39 Branches

123 Contributors

Updated on 12 Sept 2024

Bundle Size

1.18 kB

Minified

631.00 B

Minified + Gzipped

Bundlephobia

Languages

JavaScript (98.41%)

TypeScript (0.85%)

Shell (0.35%)

C++ (0.29%)

Python (0.09%)

Total Downloads

Cumulative downloads

Total Downloads

50,955,629

Last day

19.7%

97,773

Compared to previous day

Last week

427,332

Compared to previous week

Last month

6.5%

1,884,362

Compared to previous month

Last year

8.1%

17,718,434

Compared to previous year

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dev Dependencies

@azure/cosmos @bugsnag/js @ffmpeg-installer/ffmpeg @google-cloud/bigquery @google-cloud/firestore @sentry/node @slack/web-api @vercel/webpack-asset-relocator-loader analytics-node apollo-server-express arg auth0 aws-sdk axios azure-storage browserify-middleware bytes canvas chromeless consolidate copy core-js cowsay esm express fetch-h2 firebase firebase-admin fluent-ffmpeg fontkit get-folder-size glob got graceful-fs graphql hot-shots ioredis isomorphic-unfetch jest jimp jugglingdb koa leveldown license-webpack-plugin lighthouse loopback mailgun mariadb memcached memory-fs mkdirp mongoose mysql node-gyp npm oracledb passport passport-google-oauth path-platform pdfkit pg pug react react-dom redis request rxjs saslprep sequelize sharp shebang-loader socket.io source-map-support stripe swig terser the-answer tiny-json-http ts-loader tsconfig-paths tsconfig-paths-webpack-plugin twilio typescript vm2 vue vue-server-renderer web-vitals webpack when

Versions

ncc

Simple CLI for compiling a Node.js module into a single file, together with all its dependencies, gcc-style.

Motivation

Publish minimal packages to npm
Only ship relevant app code to serverless environments
Don't waste time configuring bundlers
Generally faster bootup time and less I/O overhead
Compiled language-like experience (e.g.: go)

Design goals

Zero configuration
TypeScript built-in
Only supports Node.js programs as input / output
Support all Node.js patterns and npm modules

Usage

Installation

npm i -g @vercel/ncc

Usage

$ ncc <cmd> <opts>

Eg:

$ ncc build input.js -o dist

If building an .mjs or .js module inside a "type": "module" package boundary, an ES module output will be created automatically.

Outputs the Node.js compact build of input.js into dist/index.js.

Note: If the input file is using a .cjs extension, then so will the corresponding output file. This is useful for packages that want to use .js files as modules in native Node.js using a "type": "module" in the package.json file.

Commands:

  build <input-file> [opts]
  run <input-file> [opts]
  cache clean|dir|size
  help
  version

Options:

  -o, --out [dir]          Output directory for build (defaults to dist)
  -m, --minify             Minify output
  -C, --no-cache           Skip build cache population
  -s, --source-map         Generate source map
  -a, --asset-builds       Build nested JS assets recursively, useful for
                           when code is loaded as an asset eg for workers.
  --no-source-map-register Skip source-map-register source map support
  -e, --external [mod]     Skip bundling 'mod'. Can be used many times
  -q, --quiet              Disable build summaries / non-error outputs
  -w, --watch              Start a watched build
  -t, --transpile-only     Use transpileOnly option with the ts-loader
  --v8-cache               Emit a build using the v8 compile cache
  --license [file]         Adds a file containing licensing information to the output
  --stats-out [file]       Emit webpack stats as json to the specified output file
  --target [es]            ECMAScript target to use for output (default: es2015)
                           Learn more: https://webpack.js.org/configuration/target
  -d, --debug              Show debug logs

Execution Testing

For testing and debugging, a file can be built into a temporary directory and executed with full source maps support with the command:

$ ncc run input.js

With TypeScript

The only requirement is to point ncc to .ts or .tsx files. A tsconfig.json file is necessary. Most likely you want to indicate es2015 support:

{
  "compilerOptions": {
    "target": "es2015",
    "moduleResolution": "node"
  }
}

If typescript is found in devDependencies, that version will be used.

Package Support

Some packages may need some extra options for ncc support in order to better work with the static analysis.

See package-support.md for some common packages and their usage with ncc.

Programmatically From Node.js

require('@vercel/ncc')('/path/to/input', {
  // provide a custom cache path or disable caching
  cache: "./custom/cache/path" | false,
  // externals to leave as requires of the build
  externals: ["externalpackage"],
  // directory outside of which never to emit assets
  filterAssetBase: process.cwd(), // default
  minify: false, // default
  sourceMap: false, // default
  assetBuilds: false, // default
  sourceMapBasePrefix: '../', // default treats sources as output-relative
  // when outputting a sourcemap, automatically include
  // source-map-support in the output file (increases output by 32kB).
  sourceMapRegister: true, // default
  watch: false, // default
  license: '', // default does not generate a license file
  target: 'es2015', // default
  v8cache: false, // default
  quiet: false, // default
  debugLog: false // default
}).then(({ code, map, assets }) => {
  console.log(code);
  // Assets is an object of asset file names to { source, permissions, symlinks }
  // expected relative to the output code (if any)
})

When watch: true is set, the build object is not a promise, but has the following signature:

{
  // handler re-run on each build completion
  // watch errors are reported on "err"
  handler (({ err, code, map, assets }) => { ... })
  // handler re-run on each rebuild start
  rebuild (() => {})
  // close the watcher
  void close ();
}

Caveats

Files / assets are relocated based on a static evaluator. Dynamic non-statically analyzable asset loads may not work out correctly

10

License

Determines if the project has defined a license.

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

Security-Policy

Determines if the project has published a security policy.

10

Packaging

Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.

5

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

5

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

1

Maintained

Determines if the project is "actively maintained".

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

Fuzzing

Determines if the project uses fuzzing.

0

SAST

Determines if the project uses static code analysis.

0

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

Reason

64 existing vulnerabilities detected

Details

Warn: Project is vulnerable to: GHSA-fpm5-vv97-jfwg
Warn: Project is vulnerable to: GHSA-7v5v-9h63-cj86
Warn: Project is vulnerable to: GHSA-93q8-gq69-wqmw
Warn: Project is vulnerable to: GHSA-fwr7-v2mv-hh25
Warn: Project is vulnerable to: GHSA-wf5p-g6vw-rhxx
Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
Warn: Project is vulnerable to: GHSA-gp2j-mg4w-2rh5
Warn: Project is vulnerable to: GHSA-wm7h-9275-46v2
Warn: Project is vulnerable to: GHSA-phwq-j96m-2c2q
Warn: Project is vulnerable to: GHSA-ghr5-ch3p-vcr6
Warn: Project is vulnerable to: GHSA-49q7-c7j4-3p7m
Warn: Project is vulnerable to: GHSA-977x-g7h5-7qgw
Warn: Project is vulnerable to: GHSA-f7q4-pwc6-w24p
Warn: Project is vulnerable to: GHSA-4gmj-3p3h-gm8h
Warn: Project is vulnerable to: GHSA-rv95-896h-c2vc
Warn: Project is vulnerable to: GHSA-mpg4-rc92-vx8v
Warn: Project is vulnerable to: GHSA-jchw-25xp-jwwc
Warn: Project is vulnerable to: GHSA-cxjh-pqwp-8mfp
Warn: Project is vulnerable to: GHSA-pfrx-2q88-qq97
Warn: Project is vulnerable to: GHSA-rc47-6667-2j5j
Warn: Project is vulnerable to: GHSA-78xj-cgh5-2h22
Warn: Project is vulnerable to: GHSA-2p57-rm9w-gvfp
Warn: Project is vulnerable to: GHSA-hhhv-q57g-882q
Warn: Project is vulnerable to: GHSA-xvf7-4v9q-58w6
Warn: Project is vulnerable to: GHSA-896r-f27r-55mw
Warn: Project is vulnerable to: GHSA-9c47-m6qq-7p4h
Warn: Project is vulnerable to: GHSA-8cf7-32gw-wr33
Warn: Project is vulnerable to: GHSA-hjrf-2m68-5959
Warn: Project is vulnerable to: GHSA-qwph-4952-7xr6
Warn: Project is vulnerable to: GHSA-p6mc-m468-83gw
Warn: Project is vulnerable to: GHSA-35jh-r3h4-6jhm
Warn: Project is vulnerable to: GHSA-4xcv-9jjx-gfj3
Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
Warn: Project is vulnerable to: GHSA-vh95-rmgr-6w4m
Warn: Project is vulnerable to: GHSA-xvch-5gv4-984h
Warn: Project is vulnerable to: GHSA-r683-j2x4-v87g
Warn: Project is vulnerable to: GHSA-5rrq-pxf6-6jx5
Warn: Project is vulnerable to: GHSA-8fr3-hfg3-gpgp
Warn: Project is vulnerable to: GHSA-gf8q-jrpm-jvxq
Warn: Project is vulnerable to: GHSA-2r2c-g63r-vccr
Warn: Project is vulnerable to: GHSA-cfm4-qjh2-4765
Warn: Project is vulnerable to: GHSA-x4jg-mjrx-434g
Warn: Project is vulnerable to: GHSA-9h6g-pr28-7cqp
Warn: Project is vulnerable to: GHSA-x565-32qp-m3vf
Warn: Project is vulnerable to: GHSA-h755-8qp9-cq85
Warn: Project is vulnerable to: GHSA-3965-hpx2-q597
Warn: Project is vulnerable to: GHSA-p8p7-x288-28g6
Warn: Project is vulnerable to: GHSA-54xq-cgqr-rpm3
Warn: Project is vulnerable to: GHSA-2rq5-699j-x7p6
Warn: Project is vulnerable to: GHSA-f5x3-32g6-xq36
Warn: Project is vulnerable to: GHSA-9r2w-394v-53qc
Warn: Project is vulnerable to: GHSA-5955-9wpr-37jh
Warn: Project is vulnerable to: GHSA-qq89-hq3f-393p
Warn: Project is vulnerable to: GHSA-4wf5-vphf-c2xc
Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3
Warn: Project is vulnerable to: GHSA-c9f4-xj24-8jqx
Warn: Project is vulnerable to: GHSA-cf4h-3jhx-xvhq
Warn: Project is vulnerable to: GHSA-cchq-frgv-rjh5
Warn: Project is vulnerable to: GHSA-g644-9gfx-q4q4
Warn: Project is vulnerable to: GHSA-4vvj-4cpr-p986
Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q
Warn: Project is vulnerable to: GHSA-6fc8-4gx4-v693
Warn: Project is vulnerable to: GHSA-776f-qx25-q3cc
Warn: Project is vulnerable to: GHSA-p9pc-299p-vxgp

Score

4.8

/10

Last Scanned on 2024-09-02

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More

Other packages similar to @vercel/ncc

@vercel/webpack-asset-relocator-loader

1.7.4

Asset relocation loader used in ncc for performing Node.js builds while emitting and relocating any asset references.

@henderea/my-ncc

1.3.9

My custom wrapper around @vercel/ncc to avoid ESM output

serverless-package-ncc

0.0.10

Serverless Framework plugin to work with @vercel/ncc

@fye/serverless-package-ncc

0.0.10

Serverless Framework plugin to work with @vercel/ncc