
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@entando/entando-bundler
Advanced tools
This application has the purpose of helping with operations regarding Entando Bundles.
It can be run as an interactive terminal application or as a single command for scripting.
At this moment, these are the supported functions:
Please see the Standard Demo Bundle for a full example of a Bundle generated using this tool.
To install this tool globally:
npm install -g ./
This tool can be run both as an interactive terminal application (inquirer.js) or as a single command for scripting purposes (commander.js).
$ entando-bundler for interactive or $ entando-bundler <command> <options> for single command
Create an env.json file with the configurations for the environment to extract the components:
{
"coreBaseApi": "http://quickstart-sales-demo.lab.entando.org/entando-de-app",
"k8ssvcApi": "http://quickstart-eci-sales-demo.lab.entando.org/k8s",
"clientId": "entando-bundler",
"clientSecret": "<insert_secret_here>"
}
Note: the clientId "entando-bundler" should be manually added to the keycloak of the source environment.
$ entando-bundler
? What do you want to do? Create a new bundle using components from an environment
? Please select an env.json file with the environment variables: env.json
? Which type of components do you want to add to the bundle? All components
Collecting all components from the provided environment...
Collecting widgets
Collecting pageModels
Collecting fragments
Collecting pages
Collecting contentTypes
Collecting contentModels
Collecting plugins
? Do you want to generate the Bundle with the selected components? Yes
? Where do you want to generate the Bundle? ./
? What's the code for the Bundle? standard-demo-bundle
? Please add a description to the Bundle: Standard Demo Bundle
Generating bundle...
$ entando-bundler from-env \
--env env.json \
--code standard-demo-bundle \
--description "Standard Demo Bundle"
For more details, please refer to:
entando-bundler from-env --help
$ entando-bundler from-git \
--thumbnail-file <thumbnail_file_path> \
--name <bundle_code> \
--namespace <k8s_namespace> \
--repository <git_repository_url>
--dry-run
--repository option will clone the repository to /tmp/tmp-ecr-bundle-repo_<TIMESTAMP> folder, gather the needed information and will remove the folder.
descriptor.yaml is expected to be at the root of the repository.
For more details, please refer to:
entando-bundler from-git help
Currently, tags are sorted using semver logic and are filtered out using /^v?\d+\.\d+.\d+/ regex, which would match tags like: v2.0.0, v1.0.12, v2.0.1-rc, etc.
Thumbnail URLs (--thumbnail-url option) have to be surrounded with quotation marks.
entando-bundler from-npm --help
FAQs
Command line interface to generate Entando Bundles
We found that @entando/entando-bundler demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.