NPM packages

Weeble imports compatible npm packages as immutable artifacts. Exact versions that pass compatibility and vulnerability checks become available automatically; flagged requests go to staff review. Passing these checks is not a guarantee that a package is safe.

Approval is version-specific. Approval of example@1.0.0 does not approve example@2.0.0.

Add an approved package

Open the approved package catalog, find the package, and select its exact version. Weeble Workspace opens and asks you to confirm the package before changing the project.

You can also add it inside VS Code:

  1. Open the Packages view in the Weeble sidebar.

  2. Select Install Package.

  3. Choose a package and an exact approved version.

The Recently approved section is a shortcut to the latest additions. It is not the complete catalog.

The extension:

  • Adds the exact version to dependencies in package.json.

  • Resolves its approved dependency graph.

  • Downloads the reviewed artifacts into node_modules for editor types and completion.

  • Verifies that artifact hashes still match the approved resolution.

After installation, the exact dependency appears under Installed and in package.json.

Note

Files under node_modules support the editor and are not uploaded as project source. Weeble resolves the approved artifacts again during deployment.

Import the package

Import the package by its npm name:

import queryString from "query-string";

const query = queryString.stringify({
  page: 2,
  sort: "newest",
});

console.log(query);

Remove a package

Use Uninstall Package… from the installed package in the Weeble sidebar. The extension removes the dependency and synchronizes the approved artifacts in node_modules.

If you edit package.json directly, run Weeble: Sync Packages afterward. Sync restores missing approved artifacts and removes obsolete artifacts previously managed by Weeble.

Request a package

If the package or version is not approved:

  1. Select the add action in the Packages view.

  2. Enter the npm package name.

  3. Enter an exact version such as 1.2.3.

  4. Wait while Weeble downloads and scans the package and its dependencies.

Compatible requests become available immediately when the vulnerability lookup succeeds with no known advisories. Known advisories or an unavailable vulnerability lookup require staff review. Install scripts are never executed, and their presence alone does not require review. Missing signature or provenance metadata is shown as a note, not a reason to wait.

Requests that fail compatibility checks are rejected with the blocker shown in VS Code. Revoked versions and artifacts that conflict with stored contents cannot be admitted automatically. Existing deployments are not automatically upgraded.

Request status

Expand My requests to see pending requests and the five most recent decisions:

  • pending — staff review is needed; inspect the scan details for the reason. Requests queued before automatic admission was introduced remain pending until staff resolves them.

  • approved — the exact version and its resolved dependency artifacts can be added. This may be an automated decision, not a human review.

  • rejected — the package was incompatible or staff declined it. Open the request to read the evidence and reason.

Select View request history… for older decisions.

The My requests view showing approved and rejected npm package versions.

Each request remains visible with its exact version and current review status.

When a package is approved, its exact transitive dependencies are approved with it. They appear separately in the public catalog because deployments resolve and verify each artifact independently.

What the scanner accepts

The importer selects the package’s browser/ESM entrypoint and validates the code reachable from it. Unused CLI, Node adapter, and alternate distribution files are not treated as deployed code. Type declarations are still retained for editor support.

It rejects packages that require:

  • Node.js built-in modules or Node globals such as process and Buffer

  • Native .node modules or binding.gyp

  • CommonJS entrypoints

  • Unsafe archive paths, links, or non-UTF-8 source files

Install scripts are never executed. Their presence is reported during review, and packages that depend on an install step will not work on Weeble.

Automatic limits are listed in Limits.

Supported project files

Weeble uploads project files that user code can import:

  • .ts

  • .js

  • .json

  • .toml

  • .yaml

  • .yml

Local editor files such as .weeble/, .vscode/, tsconfig.json, lockfiles, and node_modules/ are not deployment source.

devDependencies are ignored during deployment.