
Security Fundamentals
Turtles, Clams, and Cyber Threat Actors: Shell Usage
The Socket Threat Research Team uncovers how threat actors weaponize shell techniques across npm, PyPI, and Go ecosystems to maintain persistence and exfiltrate data.
@esbuild/linux-x64
Advanced tools
The @esbuild/linux-x64 npm package is a pre-compiled binary of esbuild for Linux x64 systems. Esbuild is an extremely fast JavaScript bundler and minifier. It compiles JavaScript and TypeScript code, bundling it together for use in the browser. It can also minify CSS. This package is specifically built to run on Linux x64 environments, providing a seamless experience for developers working on these systems.
JavaScript and TypeScript bundling
This feature allows you to bundle JavaScript and TypeScript files into a single file. The code sample demonstrates how to bundle an entry file named 'app.js' into an output file named 'out.js'.
require('esbuild').build({
entryPoints: ['app.js'],
bundle: true,
outfile: 'out.js',
}).catch(() => process.exit(1))
Minifying JavaScript
This feature enables the minification of JavaScript files to reduce their size for production. The code sample shows how to minify a JavaScript file named 'app.js' into a smaller file named 'out.min.js'.
require('esbuild').build({
entryPoints: ['app.js'],
minify: true,
outfile: 'out.min.js',
}).catch(() => process.exit(1))
CSS bundling and minification
Esbuild can also bundle and minify CSS files. This code sample demonstrates bundling and minifying a CSS file named 'app.css' into 'out.css'.
require('esbuild').build({
entryPoints: ['app.css'],
bundle: true,
minify: true,
outfile: 'out.css',
}).catch(() => process.exit(1))
Webpack is a powerful module bundler for JavaScript applications. It offers a wide range of plugins and loaders to transform and bundle assets. Compared to @esbuild/linux-x64, webpack is more configurable but generally slower in terms of build time.
Rollup is another JavaScript module bundler that focuses on producing smaller bundles by eliminating unused code. It is particularly well-suited for libraries. Rollup is more similar to esbuild in terms of speed but does not match esbuild's raw performance.
Parcel is a web application bundler that offers out-of-the-box support for many web development languages and frameworks. It is known for its zero-configuration approach. Parcel provides a good balance between speed and ease of use but is generally slower than esbuild.
This is the Linux 64-bit binary for esbuild, a JavaScript bundler and minifier. See https://github.com/evanw/esbuild for details.
0.25.2
Support flags in regular expressions for the API (#4121)
The JavaScript plugin API for esbuild takes JavaScript regular expression objects for the filter
option. Internally these are translated into Go regular expressions. However, this translation previously ignored the flags
property of the regular expression. With this release, esbuild will now translate JavaScript regular expression flags into Go regular expression flags. Specifically the JavaScript regular expression /\.[jt]sx?$/i
is turned into the Go regular expression `(?i)\.[jt]sx?$`
internally inside of esbuild's API. This should make it possible to use JavaScript regular expressions with the i
flag. Note that JavaScript and Go don't support all of the same regular expression features, so this mapping is only approximate.
Fix node-specific annotations for string literal export names (#4100)
When node instantiates a CommonJS module, it scans the AST to look for names to expose via ESM named exports. This is a heuristic that looks for certain patterns such as exports.NAME = ...
or module.exports = { ... }
. This behavior is used by esbuild to "annotate" CommonJS code that was converted from ESM with the original ESM export names. For example, when converting the file export let foo, bar
from ESM to CommonJS, esbuild appends this to the end of the file:
// Annotate the CommonJS export names for ESM import in node:
0 && (module.exports = {
bar,
foo
});
However, this feature previously didn't work correctly for export names that are not valid identifiers, which can be constructed using string literal export names. The generated code contained a syntax error. That problem is fixed in this release:
// Original code
let foo
export { foo as "foo!" }
// Old output (with --format=cjs --platform=node)
...
0 && (module.exports = {
"foo!"
});
// New output (with --format=cjs --platform=node)
...
0 && (module.exports = {
"foo!": null
});
Basic support for index source maps (#3439, #4109)
The source map specification has an optional mode called index source maps that makes it easier for tools to create an aggregate JavaScript file by concatenating many smaller JavaScript files with source maps, and then generate an aggregate source map by simply providing the original source maps along with some offset information. My understanding is that this is rarely used in practice. I'm only aware of two uses of it in the wild: ClojureScript and Turbopack.
This release provides basic support for indexed source maps. However, the implementation has not been tested on a real app (just on very simple test input). If you are using index source maps in a real app, please try this out and report back if anything isn't working for you.
Note that this is also not a complete implementation. For example, index source maps technically allows nesting source maps to an arbitrary depth, while esbuild's implementation in this release only supports a single level of nesting. It's unclear whether supporting more than one level of nesting is important or not given the lack of available test cases.
This feature was contributed by @clyfish.
FAQs
The Linux 64-bit binary for esbuild, a JavaScript bundler.
The npm package @esbuild/linux-x64 receives a total of 39,616,782 weekly downloads. As such, @esbuild/linux-x64 popularity was classified as popular.
We found that @esbuild/linux-x64 demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security Fundamentals
The Socket Threat Research Team uncovers how threat actors weaponize shell techniques across npm, PyPI, and Go ecosystems to maintain persistence and exfiltrate data.
Security News
At VulnCon 2025, NIST scrapped its NVD consortium plans, admitted it can't keep up with CVEs, and outlined automation efforts amid a mounting backlog.
Product
We redesigned our GitHub PR comments to deliver clear, actionable security insights without adding noise to your workflow.