We Keep Coding

Unable to install NPM packages for project in Visual Studio Code on Mac

I will preface by saying I am a complete beginner at coding, and I signed up for the free trial of Pluralsight. I have spent the last four hours trying to get the very first project set up, as I have a mac and very few of the commands recommended by Pluralsight work on this computer. The project, cloned from git, is called web-dev-starter. Currently, I am trying to connect the Node packages needed for the project using the command
web-dev-starter> npm install
This returns
zsh: command not found: web-dev-starter
I have tried a lot of things and nothing works. Many thanks to whoever can help, I really want to learn to code and am considering buying a windows computer because trying to learn on a mac has been a nightmare! Thanks!

web-dev-starter> means the current directory from the file that you just clone. and after you are in that directory you just need to do npm install

Best way to audit dependencies in Yarn 2 (berry)?

I'm looking for a way to audit dependencies for vulnerabilities in Yarn 2. In Yarn 1.x it was possible the same was as in npm, by running yarn audit instead of npm audit. But with Yarn 2 there is no such command. And according to this issue on the berry github, it won't be implemented (project maintainers prefer it was done via plugin).
I have tried running npm install --package-lock-only && npm audit but the install chokes on some of my local packages (which I am listing in package.json using the link: url type).
It wouldn't be a complex plugin to build and I'm up for some fun doing so, but it would not be so muchfun as just installing something and then going about my day. I have looked around but always end up at the same couple of vapourware / abandonware repos.
But I still guess that I'm just not finding them. Or there's an undocumented trick for making it easy. Hence my question :)
PS, yeah I can delete the local packages using link: temporarily while I run the npm install and npm audit commands above, but it's not exactly the kind of thing I want to try and automate for CI.

Update (28-Oct-2020):
Yarn 2 just merged long-awaited yarn npm audit enhancement.
PR - https://github.com/yarnpkg/berry/pull/1892
Docs - https://yarnpkg.com/cli/npm/audit
I was experimenting with Yarn 2 recently, and I saw that you can do this with #efrem/auditdeps utility:
yarn dlx #efrem/auditdeps [--level=(low|moderate|high|critical)] [--production]
The output is not as pretty as from npm audit, but you get more details in JSON format and you can pipe it to other tools or to any custom reformatting script to get exactly what you want.

I'd try https://snyk.io/ not free for huge team commercial use, but it could get you started on daily runs etc.
( I'm not affiliated in any way with Snyk.io )

WebHookIt development -- Y! Pipes extension and replacement

So Y!Pipes is shutting down, no real alternatives exist, especially none quite similar to Y!Pipes.
WebHookIt, here for the sources, seems like a potentially good alternative, keeping the simplicity of Y!Pipes' interface, and quite a potential to do what Y!Pipes does, and more: open-source, javascript generator (allowing to host "pipes" on google scripts for example).
However, that's a project that was launched a few years ago, and the dev left soon thereafter. There is work to be done on it, and the user documentation is next to non-existent.
I know SX is absolutely not a forum but I'd like to use this very generic question: "anyone to help me update and complete WebHookIt?" to gather all contributions on it. If it takes, we'll move on to a fork on github.
WebHookIt is coded in javascript using node.js. I can code a bit in javascript, but I'm a newbie regarding node.js (though I'll be very invested in the project for the time being, and I'll begin by getting on page with node as soon as tomorrow).
I'll start with the installation, for *buntu systems:
First the dependencies: npm (node.js installer), node.js, and mango-db:
npm:
install: sudo npm install npm -g
check install with npm -v
you will probably run into trouble later when trying to install webhookit (or anything I think) over the ownership of npm, as I did, if you don't claim it. Hence that generic enough command: sudo chown -R $(whoami) $HOME/.npm
node.js
taaem has made a script to download the latest node and satisfy dependencies. Download "node-install.sh".
make it executable: chmod +x node-install.sh
execute it: ./node-install.sh
follow instructions.
mango-db: follow instruction on their install page. Herein reproduced:
add mango-db repository key: sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv 7F0CEB10
add repository to the sources: echo "deb http://repo.mongodb.org/apt/ubuntu "$(lsb_release -sc)"/mongodb-org/3.0 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-3.0.list
update package database: sudo apt-get update
install mango-db packages: sudo apt-get install mongodb-org*
start mango-db service (it should already be started): sudo service mongod start
WebHookIt is installed by first downloading the repository on github. Now, if you try to install right away you'll run into trouble. This is an old project (latest commit is 3 years old), and the developer didn't provide for improvement to npm. Hence the following steps:
download the sources. With git installed: git clone git://github.com/neyric/webhookit.git
go into the webhookit folder, just created, and edit "package.json". Here is the list of the required dependencies, amongst other info about the program.
find the npm line (should be the 27th), and add ">=" before the version number. End result is: "dependencies": { ... "npm": ">=1.1.0-2", ... },
install! When into the "webhookit" folder, execute: npm install .
a few warnings will pop up, from node being more recent than required by the dependencies. As node is still in the same major version, it shouldn't be a problem (if well developed, a software shouldn't have compatibility problems within a given major revision (eg the first number)).
start webhookit server! node server.js
start using it, in your web browser, by default at http://localhost:8124
Next step is to figure out what it means when it says "Open a wiring first."...

Node.js / npm - anyway to tell if a package is pure JS or not?

I've noticed that in trying to get seemingly simple node packages to install with npm (e.g. nerve, a "micro-framework") I often run into some form of dependency pain. After some digging, I tracked down the problem with nerve to the bcrypt module, which is apparently written in C/C++ and has to be compiled after the package manager downloads it.
Unfortunately, it seems like if you want this to work on Windows, the answer is (from one of the bcrypt issues threads) "install a Linux VM". So earlier today I did just that, and started running into other dependencies (you need certain unnamed apt packages installed before you can even think about building, despite GCC being installed), then eventually after seeing yet another C compiler error (about some package or other not being able to find "Arrays.c" I think), I actually gave up, and switched from nerve to express instead. Ironically, the larger and more complicated express installs with npm on Linux and Windows without a single issue.
So, my question is: is there any filter / dependency tracking available that lets you see if a package has additional dependencies besides node core? Because to me the allure of node is "everything in Javascript", and this kind of stuff dispels the illusion quite unpleasantly. In fact, despite having done more than my time working with C/C++, whenever I see a requirement to "make" something these days I generally run in the other direction screaming. :)

The first solution doesn't tell you if a dependency makes the package impure or not. Much better to search for gyp generated output:
find node_modules/ | grep binding.gyp || echo pure

Look out for the "scripts" field in the package.json.
If it contains something like
"scripts": {
"install": "make build",
}
and a Makefile in the root directory, there's a good possibility that the package has some native module which would have to be compiled and built. Many packages include a Makefile only to compile tests.
This check on the package documents does not exclude the possibility that some dependency will have to be compiled and built. That would mean repeating this process for each dependency in the package.json, their dependencies and so on.
That said many modules have been updated to install, without build on Windows, express for one. However that cannot be assured of all packages.
Using a Linux VM seems to be the best alternative. Developing Node.js applications on Window gives you step by step instructions on installing a VM, Node.js and Express.

Node is not "everything javascript" , since one way to extend node core is to write c/c++ plugins.
So Node is more a javascript wrapper around c/c++ modules using V8.
How could you write efficient database drivers in pure javascript for instance ? it would be possible but slow.
as for the filters , it is up to the author to document his package. there is no automatic filter.

package.json generation / npm unused packages

I'm introducing unit testing in my project and for this, I need to make myself a package.json file.
First question is, which unit testing suite are you using? I'm looking forward mocha which seem to be pretty much standard for Node.js projects.
Second question is: Is there any magical way of generating a package.json file? (for dependencies and versions)
Third question is: I've been testing a lot of npm packages while developing my project and now I'm stuck with a lot of probably unused packages. Is there any way to tell which one are useless? (I saw npm list installed which is useful though)

I am using Mocha.
npm init
npm ls will list "extraneous" next to ones that are not in your package.json. But, it sounds like you don't have a package.json yet.
Basically, your workflow is very backward. Here is how it is intended to work:
Start a new project with npm init. It has no dependencies.
Oh, I want to start using a package, say express? Add it to package.json under dependencies, then run npm install.
Oh, I want to start using a package for development, say mocha? Add it to package.json under devDependencies, then run npm install.
You seem to have some existing code with manually-installed packages (via npm install <packageName>), which is a mess. I suggest starting over and following the above workflow.

To answer the third question:
npm prune
will remove all installed modules that are no longer mentioned in your package.json.
And you should really have asked 3 separate questions.

I am also using Mocha. It has code coverage, BDD, TDD, runs in browser. It is pretty complete and also heavily maintained by I think one of the most brilliant javascript/node.js programmers named TJ.
It is almost impossible to guess which version(s) to use. Because npm does not know which version breaks which dependencies. You could probably install all dependencies using something like node-detective. Then you can just install them using npm.js from within javascript. Maybe I would like to tackle this in the future.
I would also probably delete all dependencies , next install needed dependencies back using step(2). But also disc-space is not such a big case anymore with the current HDs.
P.S: I think I also agree with Domenic

I am using vows. It's pretty good, but not perfect. I have found unit testing in node to often be challenging because of async callbacks to dbs & such, and have mostly been testing top level functionality.
Here's your magic: Managing Node.js Dependencies with Shrinkwrap.
The only way to know what packages you are using is to know. You can't generate this programmatically. My advice would be to remove packages aggressively, then retest all functionality - if it breaks, you'll know you need to reinstall one of your packages.

Answering your third question, you can use Sweeper to list unused dependencies, and them remove them from your package.json. Just npm install -g sweeper then on your project directory call sweeper on the command line.