
Research
/Security News
Toptal’s GitHub Organization Hijacked: 10 Malicious Packages Published
Threat actors hijacked Toptal’s GitHub org, publishing npm packages with malicious payloads that steal tokens and attempt to wipe victim systems.
@bkwld/cloak
Advanced tools
Opinionated Nuxt boilerplate with support for Craft and Contentful.
The recommended way to use Cloak is to install it with yarn create cloak-app
. This command use create-cloak-app
and will scaffold a new Nuxt app that uses Cloak.
From your project's nuxt.config.coffee
:
# Make boilerplate, setting some options
{ mergeConfig, makeBoilerplate } = require '@bkwld/cloak'
boilerplate = makeBoilerplate
siteName: 'My Site'
cms: 'craft'
pageTypes: ['towers_towers_Entry']
# Merge project specific config with cloak boilerplate
module.exports = mergeConfig boilerplate,
# Append additional internal routes for vue-routing-anchor-parser
anchorParser: internalUrls: [
/^https?:\/\/(www)?\.domain\.com/
]
# Customize routes
router: extendRoutes: (routes, resolve) ->
# Make all path params required in detail routes
detailRoutes = ['blog-tag-tag', 'blog-category-article']
routes.filter ({ name }) -> name in detailRoutes
.forEach (route) -> route.path = route.path.replace /\?/g, ''
# Append routes from boilerplate
return boilerplate.router.extendRoutes routes, resolve
These are options you can pass to makeBoilerplate
. See the source code for defaults.
Property | Description |
---|---|
siteName | Name of site gets prepended to the <title> and used in PWA manifest. |
polyfills | Array of polyfill.io keywords, for example URL . |
Property | Description |
---|---|
cms | May be empty, craft , or contentful . |
pageTypes (if Craft) | An array of Craft _typename values. |
pageTypes (if Contentful) | An array of objects with the following properties: contentType (a Contentful contentType string), routeField (the field that holds the value you'll use in your route, defaults to "slug" ), and route (a function that is passed the value from the routeField and which should return a route path). |
generateOnlyRoutes | Craft only. Typically we generate a gql query per pageType that fetches the data for all entries, passing their data into the page components as the payload. Set this to true to disable this. You would do this on sites with many entries because this query becomes very expensive for Craft to execute. |
Property | Description |
---|---|
imgixUrl | For example, https://project.imgix.net . |
srcsetWidths | Array of integer widths that are used to make the Visual srcSet. |
placeholderColor | The default placeholder color for Visual. |
The following ENV variables are expected to use Contentful
Property | Description |
---|---|
CONTENTFUL_SPACE | The space id. |
CONTENTFUL_ACCESS_TOKEN | The Delivery API access token. |
CONTENTFUL_PREVIEW_ACCESS_TOKEN | The Preview API access token. |
CONTENTFUL_PREVIEW | Set to true use the Preview API rather than the Delivery API. Aka, to return draft/changed entries. |
To enable Sentry logging, you'll need to set the following ENV variables:
Property | Description |
---|---|
SENTRY_DSN | This will be provided when you create a new project in Sentry. |
SENTRY_AUTH_TOKEN | Get this from your user API settings. You need the org:read and project:releases permissions for the token (per authToken docs from sentry-webpack-plugin ). |
You also need to create a .sentryclirc
as described here. create-cloak-app
will have already created this. Example:
[defaults]
org=bukwild
project=my-project
Besides providing a bunch of nuxt.config boilerplate, this project also provides these shared resources:
@$craft
and @$defer
are available in all components.cjs
module syntax for to make developing via yarn link simpler. I tried using esm
package but it ran into issues with imports of imports.webpack-graphql-loader
to work around issues with the loader not being found from the root package. I think because it referenced some old and unecessary deps.Page View
dataLayer event for firing Page View style tags from GTMFAQs
Opinionated Nuxt boilerplate with support for Craft and Contentful.
We found that @bkwld/cloak demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Threat actors hijacked Toptal’s GitHub org, publishing npm packages with malicious payloads that steal tokens and attempt to wipe victim systems.
Research
/Security News
Socket researchers investigate 4 malicious npm and PyPI packages with 56,000+ downloads that install surveillance malware.
Security News
The ongoing npm phishing campaign escalates as attackers hijack the popular 'is' package, embedding malware in multiple versions.