
Research
/Security News
PolinRider Spreads Through Compromised GitHub Accounts and Packagist
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.
@distilled.cloud/cloudflare-bundler
Advanced tools
@distilled.cloud/cloudflare-bundlerDeprecated: prefer
@distilled.cloud/cloudflare-rolldown-plugininstead.
Effect-native Cloudflare Workers bundler built around a common core API with a Rolldown backend.
bun add @distilled.cloud/cloudflare-bundler effect@beta rolldown
import * as NodeFileSystem from "@effect/platform-node/NodeFileSystem";
import * as NodePath from "@effect/platform-node/NodePath";
import * as Effect from "effect/Effect";
import * as Layer from "effect/Layer";
import { Bundler } from "@distilled.cloud/cloudflare-bundler";
import { RolldownBundler } from "@distilled.cloud/cloudflare-bundler/rolldown";
const program = Effect.gen(function* () {
const bundler = yield* Bundler;
return yield* bundler.build({
main: "./src/index.ts",
rootDir: "/absolute/path/to/project",
outDir: "/absolute/path/to/project/dist",
minify: true,
cloudflare: {
compatibilityDate: "2026-03-10",
compatibilityFlags: ["nodejs_compat"],
additionalModules: {
rules: [{ type: "CompiledWasm", globs: ["**/*.wasm"] }],
},
},
});
});
const layer = Layer.provide(RolldownBundler, Layer.mergeAll(NodeFileSystem.layer, NodePath.layer));
const result = await Effect.runPromise(Effect.provide(program, layer));
console.log(result.outDir, result.main, result.modules, result.warnings);
build() returns an Output with:
outDir: absolute output directorymain: relative path to the entry chunk within that directorymodules: all emitted modules, including the main ESM chunk and supported asset moduleswarnings: normalized build warningsThe public API is centered on:
Bundler in src/Bundler.tsOutput in src/Output.tsModule in src/Module.tsThe current backend is:
RolldownBundler from @distilled.cloud/cloudflare-bundler/rolldownmainrootDir, outDir, define, external, minify, keepNames, tsconfig, sourcemapcloudflare.compatibilityDate, cloudflare.compatibilityFlagscloudflare.additionalModules.rules, cloudflare.additionalModules.preserveFileNamescloudflare:* externalsunenv and Cloudflare presets__STATIC_CONTENT_MANIFESTMIT
FAQs
Effect-native bundler for Cloudflare Workers.
The npm package @distilled.cloud/cloudflare-bundler receives a total of 100 weekly downloads. As such, @distilled.cloud/cloudflare-bundler popularity was classified as not popular.
We found that @distilled.cloud/cloudflare-bundler demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

Company News
Allow myself to introduce... myself.