
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
@astropub/vite-plugin-file
Advanced tools
A Vite plugin for seamless access to file metadata and data streams, supporting modern Web API interfaces like Blob, File, and ArrayBuffer
vite-plugin-file enables seamless access to file information and data in Vite projects.
ReadableStream.ArrayBuffer, Blob, or File.?file imports.Install the plugin:
npm install @astropub/vite-plugin-file
Add the plugin to your Vite configuration file:
// vite.config.js
import vitePluginFile from "@astropub/vite-plugin-file"
export default {
plugins: [vitePluginFile()]
}
Add the ?file suffix to any file import to access its metadata and contents.
import FaviconIco from "./assets/favicon.ico?file"
Retrieve basic metadata about any file.
import FaviconIco from "./assets/favicon.ico?file"
console.log(FaviconIco.name) // "favicon.ico"
console.log(FaviconIco.type) // "image/x-icon"
console.log(FaviconIco.size) // 9608
console.log(FaviconIco.lastModified) // 1735689600000
Stream any file efficiently without loading it into memory.
import FaviconIco from "./assets/favicon.ico?file"
const stream = FaviconIco.stream() // ReadableStream
const response = FaviconIco.response() // Response (with pre-configured headers)
Access the file as ArrayBuffer, Blob, or File.
import FaviconIco from "./assets/favicon.ico?file"
const buffer = await FaviconIco.arrayBuffer()
console.log(buffer.byteLength) // 9608
const blob = await FaviconIco.blob()
console.log(blob.type) // "image/x-icon"
const file = await FaviconIco.file()
console.log(file.name) // "favicon.ico"
console.log(file.lastModified) // 1735689600000
Retrieve the file metadata as HTTP-style headers.
import FaviconIco from "./assets/favicon.ico?file"
const headers = FaviconIco.headers()
console.log(headers.get("content-type")) // "image/x-icon"
console.log(headers.get("content-length")) // "9608"
console.log(headers.get("last-modified")) // "Wed, 01 Jan 2025 00:00:00 GMT"
Licensed under the MIT-0 License.
Enjoy!
FAQs
A Vite plugin for seamless access to file metadata and data streams, supporting modern Web API interfaces like Blob, File, and ArrayBuffer
The npm package @astropub/vite-plugin-file receives a total of 345 weekly downloads. As such, @astropub/vite-plugin-file popularity was classified as not popular.
We found that @astropub/vite-plugin-file demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.