Search for a command to run...
Simple Instructions for Publishing Your Initial NPM Package
Specialized in uncovering vulnerabilities within software supply chains and dependency ecosystems. Creator of SCAGoat and other open-source security tools. Speaker at Black Hat, DEF CON, and AppSec conferences with research on malicious package detection, dependency confusion, and CI/CD security.
No comments yet. Be the first to comment.
What the Axios malicious package contained, how it was published, and how teams can check GitHub, Intune, CrowdStrike, and Jamf.
As security researchers, we often analyze vulnerabilities in isolation. A Remote Code Execution (RCE) in a web app is one thing; sharepoint compromise in an enterprise cloud is another. But what happens when these two converge? To understand the true...
1. Introduction: The Attack of the Code Worm Imagine building a project with a set of Lego bricks, but one of the bricks is secretly malicious. Not only is it a bad piece, but it also has the ability to copy itself and sneak into all the other Lego s...
Static code analysis has come a long way from the days of simple string searches. With the rising complexity of applications and threats, our tooling has evolved to meet the demand for both precision and context-awareness. This blog takes you through...
In a startling turn of events, the widely-used Nx build system fell victim to a sophisticated supply chain attack. On August 26, 2025, malicious versions of the Nx packages were published to the npm registry, compromising the systems of potentially t...
If you’ve ever wanted to share your code with the world, contributing to the vibrant JavaScript ecosystem by publishing an NPM package is a great starting point. Whether you want to create a simple utility or a robust library, this guide will walk you through the process, step-by-step. By the end of this article, you’ll have the knowledge and confidence to publish your first package on NPM.
NPM (Node Package Manager) is a platform used by developers to distribute and manage JavaScript packages. An NPM package can include a variety of resources—code libraries, command-line tools, or front-end assets—packaged and shared for reuse.
Publishing an NPM package not only benefits the developer community but also allows you to streamline development workflows. It enables developers to save time through code reuse, promote efficient development, and ensure consistent functionality across projects:
Showcase your skills and build your portfolio.
Save time by reusing your code across projects.
Collaborate with the open-source community.
Let’s get started!
Before publishing, you need to structure your project and prepare key files:
Install Node.js and NPM
Ensure you have Node.js installed. This also installs NPM.
Check the installation by running:
node -v
npm -v
Initialize Your Package
In your project directory, run:
npm init
Follow the prompts to create a package.json file, which defines your package metadata (e.g., name, version, description).
Directory Structure
Ensure your project’s structure is clean and modular: Organize your files in a way that separates concerns and makes the codebase easy to understand. A clean structure not only helps other developers navigate your project but also simplifies maintenance and debugging.
my-package/
├── index.js # Main file
├── package.json # Package metadata
├── README.md # Documentation
├── .npmignore # Files to exclude
Now, it’s time to develop the functionality for your package. Writing modular, reusable code ensures your package is maintainable and easily adaptable for future updates. Modular code also makes it more accessible for others to integrate and contribute, fostering better collaboration within the developer community.
Start Simple
Let’s create a function that formats dates:
// index.js
module.exports = function formatDate(date) {
return new Date(date).toLocaleDateString();
};
Test Locally
Use npm link to test your package in a separate project:
npm link
cd ../test-project
npm link my-package # This will download the package to npm_modules in your test-project
Document Your Code
Create a README.md file to explain:
What your package does.
Installation instructions.
Example usage:
## Installation
```bash
npm install my-package
```
## Usage
```javascript
const formatDate = require('my-package');
console.log(formatDate('2025-01-10'));
```
Add a License
Specify an open-source license (e.g., MIT, Apache). Add it to package.json:
"license": "MIT"
Include a LICENSE file in your project.
Set Up .npmignore
Prevent unnecessary files from being published:
node_modules
.git
.env
Version Your Package
Use semantic versioning: MAJOR.MINOR.PATCH.
Run:
npm version 1.0.0
Ready to share your package with the world?
Log In to NPM
If you don’t have an account, create one here.
Log in via the CLI:
npm login
Publish Your Package
Run the command:
npm publish
You’ll see a success message, and your package will be live on npmjs.com.
Common Issues that you may come across:
ERR_PACKAGE_NAME_TAKEN: Choose another name.
Permission errors: Ensure you’re logged in correctly.
Publishing is just the beginning. Keep your package relevant and useful:
Fix Bugs
Add Features
Update your code and increment the version appropriately:
npm version 1.1.0
npm publish
Engage With the Community
Publishing an NPM package is a rewarding way to share your code, contribute to the developer community, and build your skills. By following this guide, you’ve learned the essential steps to create, document, and publish your first package. Remember, the skills you’ve developed here are just the beginning of your open-source journey. Keep exploring additional resources and experimenting with new projects to expand your expertise.
Now it’s your turn. Start building and publishing today to leave your mark in the JavaScript ecosystem!