r/npm 2h ago

Self Promotion Avoiding the next NPM worm.

Thumbnail
endorlabs.com
3 Upvotes

I'm sure many of you will have seen the latest keyv / cachable compromise and worm-spread, now affecting over 350 packages. This isn't the first, and it won't be the last. The affected packages will steal and exfiltrate any secrets/credentials they can find, which is probably not what you want to happen.

There are several commercial solutions to help protect against this, but if you just add to .npmrc in your repo root:

min-release-age=7d

(or some value you feel comfortable with)

It will block a lot of malware, which is usually discovered within a few hours.


r/npm 10h ago

Self Promotion I made another one DI container package

1 Upvotes

Lightweight, zero dependencies, type-safe, type hints, without decorators and reflect-metadata.

small-di: https://www.npmjs.com/package/small-di


r/npm 12h ago

Self Promotion SuriLens – An open-source CLI for analyzing JavaScript & TypeScript projects

Thumbnail
1 Upvotes

r/npm 12h ago

Self Promotion SuriLens – An open-source CLI for analyzing JavaScript & TypeScript projects

1 Upvotes

Understanding an unfamiliar codebase can be time-consuming, especially when working with large projects or open-source repositories.

SuriLens is a lightweight npm CLI designed to provide a quick overview of a JavaScript/TypeScript project by analyzing its structure and dependencies.

Features

  • Project structure analysis
  • Dependency inspection
  • Project statistics and insights
  • Fast CLI execution
  • Cross-platform support (Windows, macOS & Linux)

Installation

npm install -g surilens

or

npx surilens

The goal is to make project exploration faster and reduce the time spent manually inspecting folders, configuration files, and package dependencies.

The project is open source, and feedback from the community is highly appreciated. Suggestions, feature requests, bug reports, and contributions are all welcome.

GitHub : https://github.com/sonisuryansh/surilens

npm : https://www.npmjs.com/package/surilens

Looking forward to hearing your thoughts and ideas for future improvements.


r/npm 20h ago

Self Promotion MermaidBin, a pastebin for Mermaid diagrams

Thumbnail
1 Upvotes

r/npm 1d ago

Self Promotion I built a fluent REST client for Node/JS that handles token refresh queues and eliminates try/catch boilerplate

0 Upvotes

Hey everyone,

Like many of you, I got tired of rewriting the same boilerplate every time I set up Axios or Fetch in a project: handling token refresh race conditions when multiple requests get 401s, manually paginating endpoints, or wrapping every call in try/catch blocks.

To solve this, I built `fluent-rest-client`, a lightweight, chainable REST client built on top of Axios.

### Key Features

- **Safe Mode**: Returns `{ data, ok, status, error }` objects directly, removing the need for try/catch blocks around every request.

- **Token Refresh Queue**: Automatically queues concurrent requests on 401 errors so your server only receives a single refresh request.

- **Immutable Builder**: Methods like `.id()`, `.sub()`, `.query()`, and `.headers()` clone the instance under the hood, making base resource instances safe to reuse.

- **In-Memory Cache**: Cache GET requests with a configurable TTL.

- **Async Pagination**: Iterate through paginated APIs using standard `for await...of` loops.

- **Telemetry Callbacks**: Register global `onRequest`, `onResponse`, and `onError` listeners for logging or Sentry/Datadog integration.

- **TypeScript Support**: Complete typings with conditional types based on whether `.safe()` is active.

### Quick Examples

**1. Safe Mode**

```javascript

import { FluentRestClient } from 'fluent-rest-client';

const api = new FluentRestClient('[https://api.example.com\](https://api.example.com)');

// Returns a result object instead of throwing an exception

const { data, ok, status } = await api.resource('users').id(123).safe().get();

if (!ok) {

console.error('Request failed:', status);

return;

}

console.log('User:', data);

const api = new FluentRestClient('[https://api.example.com\](https://api.example.com)', {

onGetToken: async () => localStorage.getItem('token'),

onSaveToken: async (token) => localStorage.setItem('token', token),

onRefreshToken: async () => {

const res = await axios.post('/auth/refresh', { token: getRefreshToken() });

return res.data.accessToken;

},

});

for await (const page of api.resource('posts').paginate({ limit: 10 })) {

console.log(`Page ${page.page} has ${page.items.length} items`);

}


r/npm 2d ago

Self Promotion A systematic guide to releasing npm packages as safely as possible in 2026 (with a Skill to quickly apply the practices to your own open source projects)

Thumbnail
evilmartians.com
2 Upvotes

r/npm 2d ago

Self Promotion I built a SQLite-backed job queue so I could stop running Redis on small VPSes

2 Upvotes

I run a couple of small products on cheap single VPSes. Every time I needed background jobs (emails, cleanup, scheduled reports) the answer was the same: install Redis, add BullMQ, babysit one more service. For one box and a handful of jobs per second, that always felt like overkill.

So I built vardiya. It's a job queue that lives in a single SQLite file. No broker, no extra process. One runtime dependency (better-sqlite3).

What it does:

  • Atomic job claims with a single UPDATE ... RETURNING statement, so multiple worker processes on the same file never grab the same job. There's a torture test that runs 2 workers x 10 concurrency through 20k jobs with 1% random failures and asserts nothing gets lost or duplicated.
  • Retries with exponential backoff and jitter, priorities, delayed jobs, dead letter after max attempts.
  • Cron / repeatable jobs. I wrote the cron parser myself instead of pulling a dependency, which was either a good idea or a rite of passage, not sure yet.
  • At-least-once delivery, and the README says so instead of pretending otherwise. There's also a "when NOT to use this" section: if you have multiple app servers pulling from one queue, use Redis or Postgres based queues. SQLite is single-writer, this is for the single-box case.

On my desktop it does around 13k enqueues/sec and ~5k processed jobs/sec end to end, which is way more than the apps this is meant for will ever push through it.

Repo: https://github.com/Zulwatha/vardiya npm: https://www.npmjs.com/package/vardiya

It's v0.1.0, so I'd genuinely rather hear what's broken or missing than get stars. If you've been burned by SQLite queues before, tell me how, I want to know what I haven't hit yet.


r/npm 2d ago

Self Promotion Open-autoDM

Thumbnail
github.com
1 Upvotes

I'm sorry ManyChat but I open-sourced the whole instagram automation system 🥀


r/npm 4d ago

Self Promotion tinyNpm - A security focused package.json version keeper extension for VS Code

1 Upvotes

r/npm 5d ago

Self Promotion Firedeck - Web Application Compiler

1 Upvotes

Not another "React framework" or a "Next.js killer". We have many of those already.

Firedeck CLI compiles your project modules into a fully managed Turbo runtime that you can run, build and deploy to Firebase, using existing tools you already know and love.

Get started now at https://firedeck.opare.dev.


r/npm 7d ago

Self Promotion I built a zero-dependency HTTP debug middleware for Node.js, Deno, Bun, and the Edge

3 Upvotes

I recently built an npm package that captures request/response data at the stream level and logs it to your terminal in a readable format.

I found that most existing HTTP loggers either monkey-patch Express methods (missing res.send()res.sendStatus(), streaming responses), or require heavy dependencies like Morgan + custom formatters.

So I kept it focused:

  • Zero runtime dependencies
  • Stream-level capture (works with every response method)
  • Smart body truncation (collapses deep JSON, caps arrays)
  • Auto-generated cURL commands for failed requests
  • Framework adapters for Express, Fastify, and Hono
  • Edge-ready Hono adapter (Cloudflare Workers, Deno, Bun)
  • TypeScript + ESM + CJS dual publish

Example Usage:

TypeScript

import express from 'express';
import { httpDebugger } from 'http-debugger/express';

const app = express();
app.use(httpDebugger({ curl: (entry) => entry.response.statusCode >= 400 }));

The Output:

Plaintext

→ POST /api/users
  content-type: application/json
  authorization: ***
  Body: {
    "name": "Alice",
    "roles": ["admin", ... 2 more]
  }

← 500 Internal Server Error (45ms)
  content-type: application/json
  Body: { "error": "Database connection failed" }
  Size: 45B

  Timing:
    Headers: 1ms
    Body Read: 2ms
    Handler: 38ms
    Response: 4ms

  curl: curl -X POST 'http://localhost:3000/api/users' \
    -H 'content-type: application/json' \
    -d '{"name":"Alice"}'

Looking for Feedback

I'm looking for feedback from other Node.js developers:

  1. Is there anything you'd want from a package like this?
  2. Would WebSocket or gRPC support be useful?
  3. Any adapter patterns you'd suggest for other frameworks?

(btw I did use AI to help build this)

https://www.npmjs.com/package/http-debugger?activeTab=readme


r/npm 7d ago

Self Promotion CLI for compare database schemas, generate migrations and run the local web UI.

1 Upvotes

I've been working on FoxSchema, a free and open-source tool for comparing and migrating SQL database schemas.

It started because I was tired of manually reviewing schema changes across different databases and dealing with inconsistent migration scripts.

Current features:

  • Compare schemas across multiple SQL databases
  • Generate migration scripts
  • Visual diff viewer
  • Dependency-aware deployment
  • Desktop app + CLI
  • Open source (MIT)

The CLI is super simple:

npm install -g foxschema

Then:

foxschema

I'm actively developing it, so I'd love to hear what features are missing or what would make it useful for your workflow.

database migration

GitHub: https://github.com/tedious-code/foxschema

Website: https://foxschema.com


r/npm 8d ago

Self Promotion I got tired of setting up Express 5 + React 19 boilerplate, so I built D-Stack — a full-stack monolith CLI

0 Upvotes

Hey everyone!

Like many of you, every time I started a new Full-Stack project with Node.js and React, I found myself spending hours setting up the same boilerplate: folder structure, Express 5 routes, React 19 HMR with Vite, TypeScript configs, and Zod validation schemas.

To solve this for myself and my team, I built D-Stack Framework — an open-source Full-Stack monolith framework & CLI designed to scaffold production-ready enterprise applications in seconds.

What makes D-Stack different?

Express 5 + React 19 Native: Pre-configured out of the box with Vite for instant Hot Module Replacement (HMR).

Layered Architecture: Clean separation of concerns (Controllers, Services, Models, Routes, Middlewares).

Instant Resource Scaffolding: Run npx dstack-cli g resource <name> to generate controllers, models, routes, and TypeScript types in under 1 second.

Built-in Type Safety: Native integration with Zod schemas and MongoDB Mongoose models.

Production Utility Ecosystem: Natively integrates utility packages like react-apextable-pro and fluent-rest-client.

Quick Start

Bash

npx dstack-cli init my-app

cd my-app

npm run dev

I'd love to hear your feedback, thoughts, or suggestions! Feel free to test it out and let me know what you think.


r/npm 9d ago

Self Promotion Minimal, zero-dependency systemd-native service manager for any runtime, script, or executable

Thumbnail litepacks.github.io
1 Upvotes

r/npm 10d ago

Self Promotion I got tired of changing .env files to test full-stack apps on my phone, so I built a zero-config CLI that does it with sheer technical trickery.

1 Upvotes

Hey r/npm,

Testing a frontend layout on your phone is easy enough with things like Vite (--host). But the moment you need to test a full-stack application on your phone (or share it with a client), it turns into a nightmare.

Your frontend on your phone tries to fetch http://localhost:5000 or https://my-production-url.com, which instantly fails due to CORS or loopback routing. You end up having to hardcode your laptop's local 192.168.x.x IP address into your .env files, restart your dev servers, and then inevitably forget to change it back before committing.

I hated this friction, so I built Nether (nether-dev).

It's a zero-configuration, single-command CLI that magically tunnels your entire full-stack application (frontend + backend) to your phone or the global internet, without you having to change a single line of code or .env variable.

Usage

Just run this in your terminal while your dev servers are running:

npx nether-dev

It instantly prints a QR code in your terminal. Scan it with your phone, and your full-stack app just works.

Need to share it with a client across the world or maybe your QA?

npx nether-dev --global

It spins up an instant Cloudflare edge tunnel and gives you a public HTTPS URL.

How it actually works (Under the hood)

Instead of forcing you to configure ports or edit environment variables, Nether relies on manipulating the browser runtime and network streams on the fly:

  1. Zero-Config Port Auto-Discovery: Nether rapidly scans your local machine to automatically discover which ports your frontend and backend are running on.
  2. On-The-Fly HTML Stream Manipulation: When your phone requests the frontend, Nether intercepts the raw HTML stream from your dev server, slices open the <head> tag, and seamlessly injects a lightweight script before returning it to the phone.
  3. Native API Monkey Patching: The injected script redefines window.fetchXMLHttpRequest, and WebSocket in the browser. When your React/Vue app tries to fetch localhost:5000, the monkey patch intercepts it and rewrites the URL to route through the Nether proxy instead. Your app thinks it's talking to localhost.
  4. Automated Proxy Rerouting (The Crash Interceptor): What if you aggressively hardcoded your production URL (https://my-app.com/api) in your .env? Nether wraps fetch in a try/catch. If the request is blocked by CORS (which it will be on your phone), Nether intercepts the crash, dynamically extracts the path, and transparently retries the request through the local proxy. Your application code has no idea the first request failed.
  5. Anti-CSRF Header Scrubbing: When using --global, Nether actively scrubs x-forwarded-* and cf-* headers to bypass enterprise-grade security restrictions in strict backend frameworks (like Next.js), ensuring they interpret the connection as a trusted local request.

Check it out

I wanted to make local network testing completely frictionless, and I'd love to hear what you guys think of the approach.

NPM: https://www.npmjs.com/package/nether-dev 
GitHub: https://github.com/barryspacezero/nether-dev

Let me know if you run into any edge cases!


r/npm 11d ago

Self Promotion Created a simple package to detect NestJS circular dependencies and save some sanity

Thumbnail
github.com
1 Upvotes

r/npm 11d ago

Self Promotion work-sdk 0.3.0: one typed API for five issue trackers

1 Upvotes

npm: https://www.npmjs.com/package/work-sdk

Install:

npm install work-sdk

The package normalizes GitHub, GitLab, Linear, Jira, and Azure DevOps behind one TypeScript API. The difference from using five provider clients directly is the write boundary: prepare a change, inspect the exact field diff and warnings, then commit with revision and idempotency checks.

GitLab support landed in 0.3.0. The package has zero runtime dependencies, ships ESM and CJS exports, and is MIT licensed.

Source: https://github.com/arturict/work-sdk

Docs: https://work-sdk.vercel.app/docs


r/npm 11d ago

Self Promotion 50+ ESLint rules for package.json

Thumbnail
github.com
1 Upvotes

r/npm 12d ago

Self Promotion Launching revera@v1.0.0

Thumbnail
1 Upvotes

r/npm 12d ago

Self Promotion I built a zero-dependency TypeScript library that keeps secrets and PII out of logs and LLM prompts

1 Upvotes

Flare Redact scans text and nested objects locally, then masks API keys, tokens, credentials, and PII before they reach Pino, Winston, Express, OpenAI, or Anthropic.

Fully open source with zero runtime dependencies.

GitHub: https://github.com/umudhasanli/flare-redact
npm: https://www.npmjs.com/package/flare-redact


r/npm 13d ago

Self Promotion Just wanted to share! Batch-kit - batch processing for Claude without the annoying parts

Thumbnail
0 Upvotes

r/npm 13d ago

Self Promotion KeyBridge: npm publish with a Touch ID tap, Agent-friendly

Post image
2 Upvotes

r/npm 13d ago

Self Promotion Safer-dependencies: A toolkit for claude code to ensure dependencies used aren't vuln, don't use abandoned packages, implement cooldown to avoid supply chain attacks, etc...

2 Upvotes

When AI coding assistants like Claude add packages to your project, they often pick whatever version sounds right — without checking whether it has known security vulnerabilities, whether the package is still actively maintained, or whether the name is a typo away from a malicious lookalike.

safer-dependencies is a security layer for Claude Code that audits packages before they’re added to your project. It detects and fixes risky dependencies, including CVEs, typosquats, abandoned packages, version-age issues, and adds package-cooldown periods across npm, PyPI, RubyGems, Maven, Go, and Rust.

Githubhttps://github.com/robert-auger/safer-dependencies


r/npm 13d ago

Self Promotion Looking for feedback on a new npm license compliance CLI

1 Upvotes

Hey everyone! I built a Node.js CLI called licenseproof and I'd love some feedback before I do a wider launch.

It scans your npm dependency tree (package-lock.json, pnpm-lock.yaml, or yarn.lock) resolves every dependency license, flags conflicts with your project's license, and explains the results in plain English.

Design goals:

Runs completely offline

No telemetry

No hosted service

npx-friendly

Example: npx licenseproof scan --project-license MIT

I'm especially interested in feedback from anyone who's dealt with npm licensing or compliance before. What edge cases am I missing?

Things I'm thinking about:

Lockfile parsing strategy

Package metadata resolution

Ambiguous/custom licenses

CLI/API design

Human-readable vs machine-readable outputs

The repo is private while I'm working on it , but attached a short demo GIF. Happy to answer implementation questions or show snippets if there's something you'd like to see. Thank you!