Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@acemarke/react-prod-sourcemaps
Advanced tools
A tool to update app sourcemaps with the original code of ReactDOM's production builds
A tool to update app sourcemaps with the original code of ReactDOM's production builds .
React has never shipped sourcemaps for any of its production build artifacts. This makes it impossible to meaningfully debug errors inside of React in production. React's source code is already hard to understand in its original form - trying figure out what's happening when all you have is single-character variable names and no comments is impossible.
In 2023 I filed a React PR at https://github.com/facebook/react/pull/26446 that updated React's build pipeline to generate sourcemaps for production artifacts. It was eventually merged, but then later reverted. Instead, React 19 will ship with optimized but unminified prod artifacts. That means that app build steps will minify React's prod artifacts themselves, and thus React's source will be debuggable.
However, that doesn't help debug current versions of React.
I've done the work to check out the tagged source code for earlier React versions, rebuilt those versions locally, and verified that the artifacts are byte-for-byte identical. I've then backported the build pipeline changes from my PR onto those older checked-out versions, and built the sourcemaps that would have been generated for each version.
The actual build changes used can be seen here:
This package includes:
This package currently includes sourcemaps for React and ReactDOM for these versions:
yarn add @acemarke/react-prod-sourcemaps
./node_modules/.bin/react-prod-sourcemaps --inputFile path/to/your/appBuild/sourcemap.js.map
# Output file will currently be written to sourcemap.remapped.js.map
The build plugin is built using unplugin, meaning we currently supports webpack, esbuild, rollup, vite and rspack (experimental).
The plugin supports the following options:
key | value | required | default | recommended | functionality |
---|---|---|---|---|---|
debug | boolean | no | false | false | enables debug logging |
preserve | boolean | no | false | false | preserves original sourcemaps and outputs remapped sourcemaps under path/to/output/sourcemap/[name].js.remapped.map |
mode | "strict" | no | undefined | "strict" | causes the build plugin to throw an error if no sourcemap files are generated by the build tool |
Warning: if sourcemap generation is not enabled by your build tool (or if it is not setup correctly), the plugin will silently fail and not perform any sourcemap remapping. We recommend setting using mode: "strict" in case you want the plugin to error in that case.
Webpack:
import { WebpackReactSourcemapsPlugin } from "@acemarke/react-prod-sourcemaps";
module.exports = {
// ...webpack config
devtool: "source-map", // or any other option that generates separate .map.js files
plugins: [WebpackReactSourcemapsPlugin({ debug: false, preserve: false })],
};
esbuild:
import { EsbuildReactSourcemapsPlugin } from "@acemarke/react-prod-sourcemaps";
esbuild.build({
// ...esbuild config
sourcemap: true, // or any other option that generates separate .map.js files
plugins: [EsbuildReactSourcemapsPlugin({ debug: false, preserve: false })],
});
Rollup:
import { RollupReactSourcemapsPlugin } from "@acemarke/react-prod-sourcemaps";
rollup({
// ...rollup config
output: {
sourcemap: true, // or any other option that generates separate .map.js files
},
plugins: [RollupReactSourcemapsPlugin({ debug: false, preserve: false })],
});
Vite:
import { ViteReactSourcemapsPlugin } from "@acemarke/react-prod-sourcemaps";
vite.build({
// ...vite config
build: {
sourcemap: true, // or any other option that generates separate .map.js files
},
plugins: [ViteReactSourcemapsPlugin({ debug: false, preserve: false })],
});
FAQs
A tool to update app sourcemaps with the original code of ReactDOM's production builds
The npm package @acemarke/react-prod-sourcemaps receives a total of 9,188 weekly downloads. As such, @acemarke/react-prod-sourcemaps popularity was classified as popular.
We found that @acemarke/react-prod-sourcemaps demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.