
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@guardian/commercial-core
Advanced tools
This directory contains the modules that are published as the @guardian/commercial-core npm package.
To install the npm package, install with your favourite package manager:
pnpm i @guardian/commercial-core
yarn add @guardian/commercial-core
npm i @guardian/commercial-core
build the package with:
pnpm build
This will build the package into the dist directory, which is what is published to npm.
To run the unit tests:
pnpm test
This might fail if the base test coverage hasn't been met. This is set in jest.config.js. Ensure you add sufficient tests to meet the threshold if you can. If this is not possible for whatever reason, you can decrease the set thresholds but this should be considered a last resort
You can add the [beta] @guardian/commercial-core label to your pull request, this will release a beta version of the bundle to NPM, the exact version will be commented on your PR.
In order to do this, run pnpm changeset. This will create a new changeset file in the .changeset directory. Commit this file with your PR.
Note: Once the beta version is released, the label will be removed from the PR, so you will need to add it again if you want to release subsequent new versions.
This repository uses changesets for version management.
To release a new version with your changes, run:
pnpm changeset add
and follow the prompts. This will create a new changeset file in the .changeset directory. Commit this file with your PR.
When your PR is merged, changeset will analyse the changes and create a PR to release the new version.
if you are part of the commercial team, you can merge the changeset PR to release the new version. If you are not part of the commercial team, you will need to ask someone who is to merge the PR for you.
FAQs
Guardian advertising business logic
The npm package @guardian/commercial-core receives a total of 839 weekly downloads. As such, @guardian/commercial-core popularity was classified as not popular.
We found that @guardian/commercial-core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.