
Research
/Security News
Weaponizing Discord for Command and Control Across npm, PyPI, and RubyGems.org
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
@axa-ch/create-pod-app
Advanced tools
This is used to easily setup a new pod.
A pod is a micro frontend for https://axa.ch/, that are usually being implemented and maintained by pod development teams. This scaffolding application makes sure that a team can start developing their SPA (Single Page Application) right away.
Please read the following steps carefully before try it!
The implementation of how PODs are integrated into axa.ch pages and processed by the Webhub CI/CD pipeline will be completely revised in 2023. The gist of the revision is that PODs will be enabled to bring their own browser-ready JavaScript bundle, and the current final bundling step in the Webhub CI/CD pipeline will be removed. As a consequence the build/bundling step of a POD will also need to be revised in the future. This means that new PODs that were set up using the current version of create-pod-add
will need a one-time update of their build process once the Webhub revision is rolled out. We currently do not foresee further sourcecode changes for POD developers due to that revision, merely changes to the build.
npm
#
, including for query parameters! So if you have a deeplink functionality for example, use hash
due to caching issues<axa-container>
. See here.o-pod-MYPODNAME .myClassXYZ
. Note that the root (<article>) tag generated for any UI-containing POD already has class="o-pod-MYPODNAME ..."
. By using this pattern for all selectors, your POD's CSS selectors are not just scoped to your application, but also have at least specificity (0,2,0), as you can check here. Thus, they will win over generic page-wide CSS rules that typically have only specificity (0,1,0), such as *:first-child
etc.position:fixed
.position:absolute
without setting position:relative
to the root tag of your applicationmidgard
core-js
Version 2 because a lot of packages have not done the migration yet and having 2 breaking versions on axa.ch is very dangerous.2.x.x
extensions: ['js', 'jsx', 'svg'],
in the babel plugin as option (babel({...}),
)npm install @axa-ch/create-pod-app -g
. VERY IMPORTANT to use the -g
⚡ flag.npm login
.create-pod-app
inside the root folder of your repo. This will create the entire environment for your pod. More details in the CLI.npm run start
to start a local dev server and compiles the src (and copies your POD properties to the index.html)npm run build
to produce the ES Module exportsnpm run release
to release to npmnpm run test
to test your code. There is a dummy test already in place as examplenpm run copy-podproperties-to-indexhtml
to copy POD properties to your index.html if you have changed the POD properties. This step is included in npm run start
. This copy mechanism is not exactly the same as on the live stage (see midgard documentation for details).npm run alt-release
to release an alternative pod version to npm. For further information take a look at the README in your pod after the creation.This repo creates a pod and configures your git repo. It also automatically sets all requirements for Midgard so that the integration happens "under the hood".
You only have to remember the POD type. This is needed for the manifest in Midgard: https://github.com/axa-ch/midgard/blob/develop/config.json and AEM: https://github.com/axa-ch/aem-all/blob/develop/hub-clientlibs/manifest.json
It contains a ES Module export and a "state of the art" DEV environment. It also has the release script for PODs set and ready to be used. Finally, it contains the SCSS in JavaScript build settings and Midgard will add vendor prefix and will take care of minification.
Check also Midgards Readme: https://github.com/axa-ch/midgard#midgard
FAQs
Script to create a default pod
We found that @axa-ch/create-pod-app demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 48 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
Security News
Socket now integrates with Bun 1.3’s Security Scanner API to block risky packages at install time and enforce your organization’s policies in local dev and CI.
Research
The Socket Threat Research Team is tracking weekly intrusions into the npm registry that follow a repeatable adversarial playbook used by North Korean state-sponsored actors.