Gathering detailed insights and metrics for @vercel/ncc
Gathering detailed insights and metrics for @vercel/ncc
Gathering detailed insights and metrics for @vercel/ncc
Gathering detailed insights and metrics for @vercel/ncc
@vercel/webpack-asset-relocator-loader
Asset relocation loader used in ncc for performing Node.js builds while emitting and relocating any asset references.
@henderea/my-ncc
My custom wrapper around @vercel/ncc to avoid ESM output
@fye/serverless-package-ncc
Serverless Framework plugin to work with @vercel/ncc
serverless-package-ncc
Serverless Framework plugin to work with @vercel/ncc
Compile a Node.js project into a single file. Supports TypeScript, binary addons, dynamic requires.
npm install @vercel/ncc
Typescript
Module System
Node Version
NPM Version
JavaScript (98.43%)
TypeScript (0.83%)
Shell (0.36%)
C++ (0.29%)
Python (0.09%)
Total Downloads
69,234,342
Last Day
100,989
Last Week
534,587
Last Month
2,498,103
Last Year
25,455,227
MIT License
9,577 Stars
605 Commits
297 Forks
104 Watchers
30 Branches
127 Contributors
Updated on May 08, 2025
Minified
Minified + Gzipped
Latest Version
0.38.3
Package Id
@vercel/ncc@0.38.3
Unpacked Size
15.79 MB
Size
3.49 MB
File Count
127
NPM Version
6.14.18
Node Version
20.18.0
Published on
Nov 15, 2024
Cumulative downloads
Total Downloads
Last Day
40.2%
100,989
Compared to previous day
Last Week
4.5%
534,587
Compared to previous week
Last Month
-12.6%
2,498,103
Compared to previous month
Last Year
58.1%
25,455,227
Compared to previous year
89
Simple CLI for compiling a Node.js module into a single file, together with all its dependencies, gcc-style.
go
)1npm i -g @vercel/ncc
1$ ncc <cmd> <opts>
Eg:
1$ ncc build input.js -o dist
If building an .mjs
or .js
module inside a "type": "module"
package boundary, an ES module output will be created automatically.
Outputs the Node.js compact build of input.js
into dist/index.js
.
Note: If the input file is using a
.cjs
extension, then so will the corresponding output file. This is useful for packages that want to use.js
files as modules in native Node.js using a"type": "module"
in the package.json file.
build <input-file> [opts]
run <input-file> [opts]
cache clean|dir|size
help
version
-o, --out [dir] Output directory for build (defaults to dist)
-m, --minify Minify output
-C, --no-cache Skip build cache population
-s, --source-map Generate source map
-a, --asset-builds Build nested JS assets recursively, useful for
when code is loaded as an asset eg for workers.
--no-source-map-register Skip source-map-register source map support
-e, --external [mod] Skip bundling 'mod'. Can be used many times
-q, --quiet Disable build summaries / non-error outputs
-w, --watch Start a watched build
-t, --transpile-only Use transpileOnly option with the ts-loader
--v8-cache Emit a build using the v8 compile cache
--license [file] Adds a file containing licensing information to the output
--stats-out [file] Emit webpack stats as json to the specified output file
--target [es] ECMAScript target to use for output (default: es2015)
Learn more: https://webpack.js.org/configuration/target
-d, --debug Show debug logs
For testing and debugging, a file can be built into a temporary directory and executed with full source maps support with the command:
1$ ncc run input.js
The only requirement is to point ncc
to .ts
or .tsx
files. A tsconfig.json
file is necessary. Most likely you want to indicate es2015
support:
1{ 2 "compilerOptions": { 3 "target": "es2015", 4 "moduleResolution": "node" 5 } 6}
If typescript is found in devDependencies
, that version will be used.
Some packages may need some extra options for ncc support in order to better work with the static analysis.
See package-support.md for some common packages and their usage with ncc.
1require('@vercel/ncc')('/path/to/input', { 2 // provide a custom cache path or disable caching 3 cache: "./custom/cache/path" | false, 4 // externals to leave as requires of the build 5 externals: ["externalpackage"], 6 // directory outside of which never to emit assets 7 filterAssetBase: process.cwd(), // default 8 minify: false, // default 9 sourceMap: false, // default 10 assetBuilds: false, // default 11 sourceMapBasePrefix: '../', // default treats sources as output-relative 12 // when outputting a sourcemap, automatically include 13 // source-map-support in the output file (increases output by 32kB). 14 sourceMapRegister: true, // default 15 watch: false, // default 16 license: '', // default does not generate a license file 17 target: 'es2015', // default 18 v8cache: false, // default 19 quiet: false, // default 20 debugLog: false // default 21}).then(({ code, map, assets }) => { 22 console.log(code); 23 // Assets is an object of asset file names to { source, permissions, symlinks } 24 // expected relative to the output code (if any) 25})
When watch: true
is set, the build object is not a promise, but has the following signature:
1{ 2 // handler re-run on each build completion 3 // watch errors are reported on "err" 4 handler (({ err, code, map, assets }) => { ... }) 5 // handler re-run on each rebuild start 6 rebuild (() => {}) 7 // close the watcher 8 void close (); 9}
No vulnerabilities found.
Reason
no dangerous workflow patterns detected
Reason
no binaries found in the repo
Reason
license file detected
Details
Reason
packaging workflow detected
Details
Reason
Found 9/10 approved changesets -- score normalized to 9
Reason
7 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 6
Reason
dependency not pinned by hash detected -- score normalized to 5
Details
Reason
security policy file detected
Details
Reason
detected GitHub workflow tokens with excessive permissions
Details
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
project is not fuzzed
Details
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
Reason
42 existing vulnerabilities detected
Details
Score
Last Scanned on 2025-04-28
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More