
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
@doddle/doddle-build
Advanced tools
一个 webpack 构建工具,思路来自于 react-scripts
npm install @doddle/doddle-build --save-dev
scripts: {
"start": "doddle-build start --port 8903", // 本地开发环境
"dev": "doddle-build dev", // 线上开发环境
"qa": "doddle-build qa", // 线上测试环境
"prod": "doddle-build prod ", // 线上正式环境
}
不同的编译指令将有一个全局变量 process.env.NODE_ENV 进行区分,其值分别对应 local,dev,qa,prod
通过在 package.json 中添加 webpack 属性,像这样:
"devDependencies": {
"@doddle/doddle-build": "^1.0.3",
"@doddle/eslint-config-doddle": "~0.0.13"
},
"webpack": {
"copyPublic": true
},
支持五种配置,如下所示: config 参数
| 参数 | 说明 | 类型 | 默认值 |
|---|---|---|---|
| title | 网站 title | string | doddle site |
| useEslint | 编译时是否开启 Eslint 检查 | boolean | false |
| useAnalyse | 是否开启打包图谱分析 | boolean | false |
| useAntd | 是否使用了 antd,使用了 antd 会单独打包 | boolean | false |
| copyPublic | 是否复制 public 文件夹下的文件到打包到 dist 目录 | boolean | false |
| publicResolvePath | 打包到 dist 目录的路径, 默认 dist 根路径 | string | './' |
| publicPath | 静态资源路径 | string | './' |
cmd 参数
doddle-build start --port 8906 // 指定端口
// 以下三个参数,主要针对的是SSR打包的支持
doddle-build dev --entry index --dist public --template none 指定了很多个变量
| 参数 | 说明 | 类型 | 默认值 |
|---|---|---|---|
| port | 端口,仅适用于 start | string | 3000 |
| open | 是否打开浏览器,仅适用于 start | boolean | false |
| entry | 入口文件,不适用于 start | string | index |
| dist | 打包目标文件夹,不适用于 start | string | dist |
| template | 是否输出 html 文件,为 none 时不输出,不适用于 start | string | yes |
2019-09-01: 添加动态 title 配置支持,修复 css HMR
2019-10-06: 添加 public 文件夹拷贝支持,完善 readme 支持
2019-10-22: 添加对 ssr 模式打包的支持,即支持入口指定,编译输出文件夹指定等特性
2020-04-01: 添加对 webpack.config.js 自定义配置的支持,支持微前端 react 子项目打包; 增加 wepack useMicroMode 配置
FAQs
a webpack compiler like react-scripts
The npm package @doddle/doddle-build receives a total of 7 weekly downloads. As such, @doddle/doddle-build popularity was classified as not popular.
We found that @doddle/doddle-build demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.