Sign Up for Free

RunKit +

Try any Node.js package right in your browser

This is a playground to test code. It runs a full Node.js environment and already has all of npm’s 400,000 packages pre-installed, including npm-hook-receiver with all npm packages installed. Try it out:

var npmHookReceiver = require("npm-hook-receiver")

This service is provided by RunKit and is not affiliated with npm, Inc or the package authors.

npm-hook-receiver v1.0.0

sample code for receiving package hooks from the npm registry


Sample code showing you how to receive a package hook from the npm registry, verify its signature, and handle its payload. This module makes a restify server that you configure to receive hook payloads at whatever path you like. The server emits events when notifications arrive. Listen for the events to do something interesting! For example, it's easy to write a Slack bot that echoes events to a Slack channel.


var makeReceiver = require('npm-hook-receiver');
var server = makeReceiver({
    secret: 'this-is-a-shared-secret',
    mount: '/hook'

server.on('hook', function(message)
    console.log(`got ${message.event} type ${message.type} on ${}`);
    console.log(`object is in ${message.payload}`);

server.on('package:star', function(message)
    console.log(`package ${} was starred by ${message.sender}!`);

server.listen(8080, function()
    console.log('Ready to receive hooks!');


This example hook receiver exports a single function that takes a config object and returns a restify server. The config object must have two required fields plus any configuration you'd like to pass along to restify's createServer() function. The two required fields are:

  • secret: the secret you've shared with the registry for the hook
  • mount: the url path you expect the hooks to be posted to

You must call listen() on the restify server yourself. The server object is an event emitter. Attach event listeners to it to act when hooks are fired.


  • hook: emitted for all successfully-received notifications. Listen for this event to handle all hooks.
  • hook:error: emitted on payload errors like missing or invalid signatures.
  • An event is also emitted for each hook event string. E.g, listen for package:star to handle only starring notifications.

See the npm hooks API documentation for the full list of events.




RunKit is a free, in-browser JavaScript dev environment for prototyping Node.js code, with every npm package installed. Sign up to share your code.
Sign Up for Free