
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@finoer/fino-cli
Advanced tools
The micro front framework tools
安装依赖
npm install
开发已经存在模版
在根目录下的tsconfing.json中的reference字段中确定需要监控的依赖包
// tsconfing.json
{
"references": [
{ "path": "./packages/finoer-core" }
]
}
运行启动命令
# 开发base模版
npm run template:base
# 其他模版项目, 在package.json中添加命令
npm run template:other
开发package包
直接npm run dev <package名称>
# 启动
npm run dev finoer-core
打包 npm run build <package名称>
# 打包
npm run build finoer-core
生成文档npm run docs <package名称>
# 打包
npm run docs finoer-core
添加新的依赖包
克隆/创建新的子模块
# 进入packages
cd packages
# 添加子模块
git submodule add https://github.com/finoer/package-startup.git
# 返回根目录
cd ..
根目录下tsconfig添加reference项目
{
"compilerOptions": {
// ...
},
"references": [
{
"path": "./packages/startup"
}
]
}
运行启动命令
npm run template:<project>
常见问题
没有监听到子模块的改变
检查根项目下tsconfig下面reference是否已经包含了子模块
检查子模块package.json入口是否正确
{
"main": "dist/index.js",
"types": "dist/index.d.ts"
}
检查子模块的tsconfig文件如下属性是否正确
{
"compilerOptions": {
"composite": true,
"outDir": "./dist/", // 指定输出目录
"baseUrl": "./src",
}
}
....
core
├─templates // 微前端项目模版
| ├─fino-child-vue // vue子项目模版
| ├─fino-child // 子项目模版
| ├─fino // 基座模版
├─src
| └index.ts
├─scripts
| ├─build.js
| ├─dev.js
| ├─docs.js
| └utils.js
├─packages // 项目依赖npm包
| ├─finoer-core // 微前端框架主npm包
| ├─finoer-component-vue // 子项目npm包
给package下面的npm包安装依赖
# npm run dev <包名>
npm run init finore-core
# 或者
npm run init finoer-component-vue
运行packages下面的npm包
# npm run dev <包名>
npm run dev finore-core
# 或者
npm run dev finoer-component-vue
# npm run build <包名>
npm run build finore-core
# 或者
npm run build finoer-component-vue
给package下的npm包生成文档
# npm run doc <包名>
npm run doc finore-core
# 或者
npm run doc finoer-component-vue

git clone
git submodule update --init --recursive
FAQs
The micro front framework tools
We found that @finoer/fino-cli demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.