
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@dream2023/itaro
Advanced tools
itaro 按需编译解决方案,从此告别改 1 行代码,编译半分钟的情况。
项目安装:
yarn add @dream2023/itaro -D # npm install --save-dev @dream2023/itaro
全局安装:
yarn global add @dream2023/itaro # npm install -g @dream2023/itaro
第 1 步:修改 package.json,增加 scripts,例如:
{
"dev:weapp": "npm run build:weapp -- --watch",
"dev:itaro": "itaro npm run dev:weapp"
}
上面演示的是启动 dev:weapp,如果是启动 build:h5,可以增加 itaro npm run build:h5,其实就是在 itaro 后面跟着启动命令。
第 2 步:修改 config/index.js 的 defineConstants 字段为:
{
defineConstants: {
'process.env.ITARO': process.env.ITARO
}
}
第 3 步:修改 app.jsx 或者 app.tsx:
// ...
class App extends Component {
// 增加一个三元表达式
config = process.env.ITARO
? process.env.ITARO
: {
pages: ["pages/index/index"],
// ...
}
}
第 1 步:修改 package.json,增加 scripts,例如:
同 1.x 和 2.x。
{
"dev:weapp": "npm run build:weapp -- --watch",
"dev:itaro": "itaro npm run dev:weapp"
}
上面演示的是启动 dev:weapp,如果是启动 build:h5,可以增加 itaro npm run build:h5,其实就是在 itaro 后面跟着启动命令。
第 2 步:修改 app.config.js 或者 app.config.ts 为:
import itaro from "@dream2023/itaro"
export default itaro({
pages: ["pages/index/index"],
// ...
})
如果你使用了本工具,强烈建议配合小程序开发工具的 自定义编译模式,一步到自定义页面。

subpackages 页面,如果选择了 root 页面,则会自动选择全部子页面;tabBar 中的页面会被自动选中,不会出现在选择列中;preloadRule 字段会被删除;itaro 会缓存用户的选择,所以当第二次启动时,会提示是否沿用之前的选择;app 的配置项(比如修改了 tabbar 或者新增了页面),再次启动时,需要重新选择来更新缓存!!!FAQs
Taro 按需编译解决方案。
We found that @dream2023/itaro demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.