
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@henderea/wrapper-webpack-plugin
Advanced tools
Wraps output files (chunks) with custom text or code.
Install locally using npm:
npm i wrapper-webpack-plugin
Version 2 of this plugin only works with webpack >=4.
For webpack <4 use version 1 of the plugin with npm i -D wrapper-webpack-plugin@1
The WrapperPlugin class has a single parameter, an object with a header and/or footer properties. Header text will
be prepended to the output file, footer text will be appended. These can be either a string or a function. A string
will simply be a appended/prepended to the file output. A function is expected to return a string, and will receive the
name of the output file as an argument.
An optional test property (a string or a RegExp object) can control which output files are affected; otherwise all output files will be wrapped.
New in 2.1:
The optional afterOptimization property can be used to avoid having the added text affected by the optimization stage, e.g. if you don't want it to be minified.
function WrapperPlugin({
test: string | RegExp,
header: string | function,
footer: string | function,
afterOptimization: bool // default: false
})
Wraps bundle files with '.js' extension in a self invoking function and enables strict mode:
const WrapperPlugin = require('wrapper-webpack-plugin');
module.exports = {
// other webpack config here
plugins: [
// strict mode for the whole bundle
new WrapperPlugin({
test: /\.js$/, // only wrap output of bundle files with '.js' extension
header: '(function () { "use strict";\n',
footer: '\n})();'
})
]
};
Prepends bundles with a doc comment:
const WrapperPlugin = require('wrapper-webpack-plugin');
module.exports = {
// other webpack config here
plugins: [
new WrapperPlugin({
header: function (fileName) {
return '/*! file: ' + fileName + ', created by dev123 */\n';
}
})
]
};
Accessing file name, build hash, and chunk hash at runtime.
const WrapperPlugin = require('wrapper-webpack-plugin');
module.exports = {
// other webpack config here
output: {
filename: '[name].[chunkhash].js'
},
plugins: [
new WrapperPlugin({
header: `(function (FILE_NAME, BUILD_HASH, CHUNK_HASH) {`,
footer(fileName, args) {
return `})('${fileName}', '${args.hash}', '${args.chunkhash}');`;
// note: args.hash and args.chunkhash correspond to the [hash] and [chunkhash]
// placeholders you can specify in the output.filename option.
}
})
]
};
Keeping header in a separate file:
file: header.js
/*!
* my awesome app!
*/
file: webpack.config
const fs = require('fs');
WrapperPlugin = require('wrapper-webpack-plugin');
const headerDoc = fs.readFileSync('./header.js', 'utf8');
module.exports = {
// other webpack config here
plugins: [
new WrapperPlugin({
header: headerDoc
})
]
};
A slightly more complex example using lodash templates:
const WrapperPlugin = require('wrapper-webpack-plugin');
const template = require('lodash.template');
const pkg = require('./package.json');
const tpl = '/*! <%= name %> v<%= version %> | <%= author %> */\n';
module.exports = {
// other webpack config here
plugins: [
new WrapperPlugin({
header: template(tpl)(pkg)
})
]
};
This plugin should play nicely with most other plugins.
E.g. adding the webpack.optimize.UglifyJsPlugin plugin to the plugins array after the WrapperPlugin will result in
the wrapper text also being minified.
FAQs
Wraps output files (chunks) with custom text or code.
We found that @henderea/wrapper-webpack-plugin demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.