--- title: "Creating an npm package in 2022" publication: "Node Weekly" issue: 454 published_at: "2022-09-15" canonical_url: "https://nodeweekly.com/issues/454" --- Plus Node 18.9, a way to lint your SQL queries, and what three dots mean for git. | #​454 — September 15, 2022 [Read on the Web](https://nodeweekly.com/issues/454) ![Node.js Weekly](https://res.cloudinary.com/cpress/image/upload/v1653576619/lgfqinzbdqttwmhvljxb.png) [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60/zji8hhxasugbku9vsrzv.jpg)](https://snyk.io/blog/best-practices-create-modern-npm-package/) [Best Practices for Creating a Modern npm Package](https://snyk.io/blog/best-practices-create-modern-npm-package/) — A step-by-step “as of 2022” walkthrough of creating your own npm package using current best practices. It’s very thorough and certainly worth revisiting, even if you’ve built a package already. As always, though, there’s more than one way to do it, and other tools like [np](https://github.com/sindresorhus/np) can be brought into the mix as needed. Brian Clark (Snyk) [![\](https://copm.s3.amazonaws.com/d06f4ffd.png)](https://buttercms.com/nodejs-cms/?utm_source=nodeweekly&utm_medium=email&utm_campaign=numberone) [🧈 ButterCMS Melts into Your Node App. #1 Rated Headless CMS](https://buttercms.com/nodejs-cms/?utm_source=nodeweekly&utm_medium=email&utm_campaign=numberone) — ButterCMS is your content backend. Enable your marketing team to update website + app content without needing you. Try the #1 rated Headless CMS for Node today. Free for 30 days. 🧈 ButterCMS sponsor [On Automatically Finding Bugs in the Node.js Ecosystem](https://nakedsecurity.sophos.com/2022/08/30/javascript-bugs-aplenty-in-node-js-ecosystem-found-automatically/) — A quick look at a recent USENIX paper '_Mining Node.js Vulnerabilities via Object Dependence Graph and Query_' ([direct PDF link](https://www.usenix.org/system/files/sec22-li-song.pdf)) about the creation of a system that creates dependency graphs and uses them to find bugs in other systems (an enterprise which resulted in 70 CVE identifiers being issued to the team so far!) Paul Ducklin (Sophos) - [Node.js 18.9.0](https://nodejs.org/en/blog/release/v18.9.0/) has been released, but it's a relatively minor release with no headline features. - ✉️ Did you know we have [a React newsletter](https://react.statuscode.com/issues/305) too? This week's issue is packed with neat stuff, including why `useSyncExternalStore` is so useful. - Christoph Nakazawa, well known for his work on Jest and Yarn, shares [how he sets up his new Macs](https://cpojer.net/posts/set-up-a-new-mac-fast). [The Basics of Remix](https://css-tricks.com/the-basics-of-remix/) — [Remix](https://remix.run/) is the up and coming full stack Web framework with a lot of neat ideas. This introduction covers all the basics of handling routing, form handling, headers, meta tags and links to get you up and running. Brittney Postma [Scraping Google Scholar Results with Node and Cheerio](https://serpdog.io/blog/scrape-google-scholar-results) — Google may well block you from doing this, but the technique applies elsewhere too. Darshan Khandelwal 📅 [Unblock - A CI/CD Conference by Buildkite](https://unblockconf.dev/22?utm_campaign=UnblockConf%202022&utm_source=ppc&utm_medium=CPress&utm_term=Node-Weekly&utm_content=Unblock-Registration) Buildkite sponsor - [Reddit OAuth: Let Users Sign into Your App with a Reddit Login](https://fusebit.io/blog/reddit-oauth/) ↳ Quick tutorial oriented around a Next.js app. - [Using Private GitHub npm repositories in AWS CodeBuild](https://dev.to/aws-builders/using-private-github-npm-repositories-in-codebuild-16b3) ↳ Not even AWS fans necessarily use CodeBuild.. :-) - [`git diff` and `..` vs `...`](http://peter.eisentraut.org/blog/2022/09/13/git-diff-and-git-log-and-dots) ↳ It's not Node specific, but if you're unaware of the difference between `git diff a..b` and `git diff a...b` – you'll find this useful. - [Secure Your Node.js App with JSON Web Tokens](https://blog.appsignal.com/2022/09/14/secure-your-nodejs-app-with-json-web-tokens) 🛠 Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60/ez7j3daeeijv58tuovhj.jpg)](https://www.safeql.dev/) [SafeQL: An ESLint Plugin for Your SQL Queries](https://www.safeql.dev/) — Clever idea. It hooks into your database and then guides you as to mistakes you might make when writing SQL queries in your JavaScript code. Postgres only for now, but supports any client.. whether Prisma, pg, Sequelize, or whatever. ts-safeql [Favicons 7.0: A Favicon Generation Library](https://github.com/itgalaxy/favicons) — Major release for a long standing library. Sharp is now used instead of Jimp, you can create maskable icons, and TypeScript has been adopted. itgalaxy inc. [Code Capsules: The Simplest Way to Deploy Your Code](https://codecapsules.io/docs/tutorials/create-nodejs-telegram-bot/) Code Capsules sponsor [zig-napigen: Automatic Node-API Bindings for Any Zig Project](https://github.com/cztomsik/zig-napigen) — [Zig](https://ziglang.org/) is a modern C-a-like language you may have heard of recently for forming the foundation of the [Bun](https://bun.sh/) JS runtime. Kamil Tomšík - [Fastify 4.6](https://github.com/fastify/fastify/releases/tag/v4.6.0) ↳ Fast Node Web framework. - [Hexo 6.3](https://github.com/hexojs/hexo) ↳ Popular Node.js blog framework. - [llnode 4.0](https://github.com/nodejs/llnode) ↳ Inspect Node processes or core dumps in LLDB. - [Generic Pool 3.9](https://github.com/coopernurse/node-pool) ↳ Resource pool with Promise based API. - [cacheable-request 10.0](https://github.com/jaredwray/cacheable-request/releases/tag/v10.0.0) ↳ Wrap native HTTP requests with RFC compliant cache support. - [Light My Request 5.6](https://github.com/fastify/light-my-request) ↳ Fake HTTP request injection library. 💻 Jobs [Full-Stack Engineer (NYC / Remote)](https://apply.workable.com/j/E0E1B15339) — 100M+ devices, 100B+ API calls. Radar is looking for Product Engineers to build geospatial dev tools. Radar [Find Tech Jobs with Hired](https://hired.com/join/?utm_source=newsletter&utm_medium=sponsor&utm_campaign=%28b2c%29%28l-all%29%28r-all%29%28cooper-nodeweekly%29&utm_content=find-your-next-job) — Create a profile on Hired to connect with hiring managers at growing startups and Fortune 500 companies. It's free for job-seekers. Hired **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. _Thanks!_ --- **Got a new address?** You can [change your email here](https://nodeweekly.com/edit_subscription/*|UID|*). --- **Want to stop this email?** [Click here to say goodbye](https://nodeweekly.com/leave/*|UID|*). --- **Want even more newsletters?** Perhaps check out [JavaScript Weekly](https://javascriptweekly.com/), [React Status](https://react.statuscode.com/) or [Frontend Focus](https://frontendfoc.us) as well :-) --- **Want to sponsor?** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Stop getting this newsletter.](https://nodeweekly.com/leave/*|UID|*)