What is npm?

• node package manager
• largest ecosystem of open source libraries
• makes it easy to share, reuse and update code
• helps us build complex things with simple parts
• not just for backend modules any more

Three parts of npm

• npm the company
  • take open source to new places
  • reduce friction
• npm the registry (free)
• npm the command line tool
  • open source
  • ships with Node.js

Module

Anything that can be loaded with require(...) in a Node.js program

Package

1. directory
   • package.json file
   • something of value (like a module)
2. gzip of (1)
3. URL that resolves to (2)
4. GIT URL that when cloned results in (1)

package.json

A text file in json format that describes your "package" and it's dependencies.

package.json

• Required properties
  • name
  • version
• Others properties
  • description
  • keywords
  • homepage
  • author, contributor
  • dependencies & devDependencies
  • main, bugs, license, scripts...

npm registry

• A website that implements the CommonJS Package Registry specification for reading package info
• Powered by CouchDB
• https://www.npmjs.com/
• Internal registry
  • http://icsnpm.ldschurch.org/

npm registry

• Search - full text
• Filtering - human
  • stars
  • version (if they follow semver)
  • downloads (relative)
  • number of releases
  • time since last release (abandoned)?
  • badges
  • author
  • does it have a readme.md and docs?
  • does it solve your problem?
  • does it solve too many problems?
  • is the license acceptable
  • how many open issues? (relative)
  • how many dependencies (relative to complexity)
  • ...

semver

1.2.3

http://semver.org/

https://github.com/npm/node-semver

major - breaking changes

minor - new features but compatible

patch - backwards compatible bug fixes

major

minor

patch

version strings

The dependencies sections of package.json specifies the name and a version string for each dependency

"dependencies": {
    "compression": "^1.5.2",
    "cookie-parser": "^1.3.5",
    "dotenv": "^2.0.0",
    "express": "^4.13.3",
    ...
}

npm shrinkwrap

• Locks down the versions of a package's dependencies so that you can control exactly which versions of each dependency will be used when you install/deploy
• You could lock down dependencies by specifying exact versions in package.json
• however npm shrinkwrap is preferred and more flexible

npm shrinkwrap

• run npm shrinkwrap
• which produces npm-shrinkwrap.json
• when npm-shrinkwrap.json is present, the npm install command honors the exact versions found within
• typically: commit the shrink wrap file to your vcs
• delete the shrink wrap file when you start your next development cycle
• npm suggests you shrink wrap your apps, not your modules

Demo

• run npm shrinkwrap in my-app
• show new npm-shrinkwrap.json and it's format
• now if we were to delete the node_modules
• and run npm i
• the versions would match the shrink wrap file

more

Updating Dependencies

• npm outdated
  • to list dependencies that have fallen behind
  • "wanted" column is the highest available version that complies with the package.json range
  • "latest" column is the highest available version within the registry

Updating Dependencies

• npm update
  • installs new versions of dependencies
  • obeys package.json version ranges
• to break out of the version range
  • manually modify package.json & run npm update or
  • uninstall and re-install each dependency

Fixing EACCESS error (without sudo)

Do you get errors installing packages globally?

1. Install Node with Homebrew
2. Use an alternate global package directory
3. Change directory permissions

https://docs.npmjs.com/getting-started/fixing-npm-permissions

3. Change Directory Permissions

• Change the owner of npm's directories to the name of the current user  
  • sudo chown -R $(whoami) $(npm config get prefix)/{lib/node_modules,bin,share}
  • or

  • sudo chown -R $USER $(npm config get prefix)/lib/node_modules

Installing Offline

• npm keeps a local cache
  • npm config get cache 
• install offline
  • npm install --cache-min 999999

Troubleshooting Tips

• delete your ./node_modules directory and re-run npm i after changing node or npm versions
• check your node and npm versions against the engines property in package.json
• others tips?

Node Versions

• Even Node versions will have "Long Term Support"
• Odd Node versions get the latest features

npm v3

• progress bar
• flat flat flat
  • = less files but a little slower

npm Versions

• Node 4 ships with npm 2
  • run npm i -g npm to have npm upgrade itself
  • remember to delete your node_modules folders
  • upgrade node or npm at the beginning of an iteration, not right before releasing
  • communicate this change to your team

npm Configuration Files

• per-project config file (/path/to/my/project/.npmrc)
• per-user config file (~/.npmrc)
• global config file ($PREFIX/etc/npmrc)
• npm builtin config file (/path/to/npm/npmrc)

npm hydra worm

npm hydra worm

In theory, malicious code could spread

through the npm ecosystem because

• npm lifecycle scripts allow arbitrary commands
• semver allows for changing dependencies
• persistent auth allows publishing without creds
• central repository acts as distribution point

Hydra Mitigation

• Do not stay logged in to npm... npm logout
• Use npm shrinkwrap to lock down dependencies
• Disable install scripts  
  • npm i <module> --ignore-scripts or
  • npm config set ignore-scripts true
• Don't install a package you don't trust
• Don't sudo your installs

npm's Hydra Mitigations

• vulnerability scanning
• two-factor authentication in public registry

Both are WIP

Hydra Worm Disclosure: http://tinyurl.com/h6cbwhu

npm response: http://tinyurl.com/hujcz85