npmpackage.info

Gathering detailed insights and metrics for npm-packlist

Other packages similar to npm-packlist

@types/npm-packlist

7.0.3

TypeScript definitions for npm-packlist

@npmcli/installed-package-contents

3.0.0

Get the list of files installed in a package in node_modules, including bundled dependencies

@pnpm/fs.packlist

2.0.0

Get a list of the files to add from a directory into an npm package

npm-pack-zip

1.3.0

Run npm pack to generate a .zip archive file

Gathering detailed insights and metrics for npm-packlist

npm-packlist

Walk through a folder and figure out what goes in an npm package

10.0.0

110

ISC

JavaScript

2,254,029,378 6.7

Installations

npm install npm-packlist

Pull Requests

Open

1

Total

204

Closed

85

Merged

118

Issues

Open

6

Total

41

Closed

35

Releases

v10.0.0

Published on 25 Nov 2024

v9.0.0

Published on 25 Sept 2024

v8.0.2

Published on 08 Jan 2024

v8.0.1

Published on 06 Dec 2023

v8.0.0

Published on 24 Aug 2023

v7.0.4

Published on 07 Dec 2022

View all 24 releases

Developer

npm

Developer Guide

BETA

Module System

CommonJS

Min. Node Version

^20.17.0 || >=22.9.0

Typescript Support

No

Node Version

22.11.0

NPM Version

10.9.1 Statistics

110 Stars

285 Commits

32 Forks

14 Watching

2 Branches

89 Contributors

Updated on 25 Nov 2024

Languages

JavaScript (100%)

Total Downloads

Cumulative downloads

Total Downloads

2,254,029,378

Last day

0.9%

1,895,982

Compared to previous day

Last week

10,201,684

Compared to previous week

Last month

12.6%

41,162,177

Compared to previous month

Last year

15.6%

457,276,197

Compared to previous year

Daily Downloads

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

ignore-walk

Dev Dependencies

@npmcli/arborist @npmcli/eslint-config @npmcli/template-oss mutate-fs tap

Versions

npm-packlist

Get a list of the files to add from a folder into an npm package.

These can be handed to tar like so to make an npm package tarball:

1const Arborist = require('@npmcli/arborist')
2const packlist = require('npm-packlist')
3const tar = require('tar')
4const packageDir = '/path/to/package'
5const packageTarball = '/path/to/package.tgz'
6
7const arborist = new Arborist({ path: packageDir })
8arborist.loadActual().then((tree) => {
9  packlist(tree)
10    .then(files => tar.create({
11      prefix: 'package/',
12      cwd: packageDir,
13      file: packageTarball,
14      gzip: true
15    }, files))
16    .then(_ => {
17      // tarball has been created, continue with your day
18    })
19  })

This uses the following rules:

If a package.json file is found, and it has a files list, then ignore everything that isn't in files. Always include the root readme, license, licence and copying files, if they exist, as well as the package.json file itself. Non-root readme, license, licence and copying files are included by default, but can be excluded using the files list e.g. "!readme".
If there's no package.json file (or it has no files list), and there is a .npmignore file, then ignore all the files in the .npmignore file.
If there's no package.json with a files list, and there's no .npmignore file, but there is a .gitignore file, then ignore all the files in the .gitignore file.
Everything in the root node_modules is ignored, unless it's a bundled dependency. If it IS a bundled dependency, and it's a symbolic link, then the target of the link is included, not the symlink itself.
Unless they're explicitly included (by being in a files list, or a !negated rule in a relevant .npmignore or .gitignore), always ignore certain common cruft files:
1. .npmignore and .gitignore files (their effect is in the package already, there's no need to include them in the package)
2. editor junk like .*.swp, ._* and .*.orig files
3. .npmrc files (these may contain private configs)
4. The node_modules/.bin folder
5. Waf and gyp cruft like /build/config.gypi and .lock-wscript
6. Darwin's .DS_Store files because wtf are those even
7. npm-debug.log files at the root of a project
You can explicitly re-include any of these with a files list in package.json or a negated ignore file rule.

Only the package.json file in the very root of the project is ever inspected for a files list. Below the top level of the root package, package.json is treated as just another file, and no package-specific semantics are applied.

Interaction between `package.json` and `.npmignore` rules

In previous versions of this library, the files list in package.json was used as an initial filter to drive further tree walking. That is no longer the case as of version 6.0.0.

If you have a package.json file with a files array within, any top level .npmignore and .gitignore files will be ignored.

If a directory is listed in files, then any rules in nested .npmignore files within that directory will be honored.

For example, with this package.json:

1{
2  "files": [ "dir" ]
3}

a .npmignore file at dir/.npmignore (and any subsequent sub-directories) will be honored. However, a .npmignore at the root level will be skipped.

Additionally, with this package.json:

{
  "files": ["dir/subdir"]
}

a .npmignore file at dir/.npmignore will be honored, as well as dir/subdir/.npmignore.

Any specific file matched by an exact filename in the package.json files list will be included, and cannot be excluded, by any .npmignore files.

API

Same API as ignore-walk, except providing a tree is required and there are hard-coded file list and rule sets.

The Walker class requires an arborist tree, and if any bundled dependencies are found will include them as well as their own dependencies in the resulting file set.

No vulnerabilities found.

10

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

Security-Policy

Determines if the project has published a security policy.

10

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

10

License

Determines if the project has defined a license.

9

SAST

Determines if the project uses static code analysis.

5

Maintained

Determines if the project is "actively maintained".

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

Reason

dependency not pinned by hash detected -- score normalized to 0

Details

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/audit.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/audit.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/audit.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/audit.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-release.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/ci-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-release.yml:47: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/ci-release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-release.yml:63: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/ci-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-release.yml:112: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/ci-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-release.yml:128: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/ci-release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-release.yml:144: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/ci-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:89: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:95: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/codeql-analysis.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/codeql-analysis.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/codeql-analysis.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/post-dependabot.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/post-dependabot.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/post-dependabot.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/post-dependabot.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/post-dependabot.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/post-dependabot.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pull-request.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/pull-request.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pull-request.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/pull-request.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-integration.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/release-integration.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-integration.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/release-integration.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:57: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:66: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:76: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:83: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:110: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:119: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:136: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:162: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:199: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:218: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:236: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:274: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:283: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:303: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/npm-packlist/release.yml/main?enable=pin
Warn: npmCommand not pinned by hash: .github/workflows/audit.yml:38
Warn: npmCommand not pinned by hash: .github/workflows/ci-release.yml:58
Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:42
Warn: npmCommand not pinned by hash: .github/workflows/post-dependabot.yml:39
Warn: npmCommand not pinned by hash: .github/workflows/pull-request.yml:42
Warn: npmCommand not pinned by hash: .github/workflows/release-integration.yml:52
Warn: npmCommand not pinned by hash: .github/workflows/release.yml:50
Warn: npmCommand not pinned by hash: .github/workflows/release.yml:130
Info: 0 out of 26 GitHub-owned GitHubAction dependencies pinned
Info: 0 out of 12 third-party GitHubAction dependencies pinned
Info: 0 out of 8 npmCommand dependencies pinned

0

Fuzzing

Determines if the project uses fuzzing.

Score

6.7

/10

Last Scanned on 2024-11-18

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More

Other packages similar to npm-packlist

Other packages similar to npm-packlist

npm-packlist

Installations

Pull Requests

1

204

85

118

Issues

6

41

35

Releases

Developer

npm

Developer Guide

CommonJS

^20.17.0 || >=22.9.0

No

22.11.0

10.9.1

Statistics

Languages

Total Downloads

2,254,029,378

Daily Downloads

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

Dev Dependencies

npm-packlist

Interaction between package.json and .npmignore rules

API

10

10

10

10

10

10

9

5

0

0

0

0

6.7

/10

Interaction between `package.json` and `.npmignore` rules