
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
@hypha/web-compiler
Advanced tools
@hypha/web-compiler v1.0.0 was forked from Bankai v9.15.0.
Bankai is an excellent “friendly web compiler” by Yoshua Wuyts, Renée Kooi, and other contributors.
If you want a general purpose web compiler, please use Bankai and back their project.
@hypha/web-compiler is a simplified version of Bankai, tuned specifically for the needs of the Hypha project. For a summary of the differences, please see the change log.
npm i @hypha/web-compiler
@hypha/web-compiler is used programmatically1 within Hypha:
@hypha/web-compiler is used by hooking it up to an HTTPS server like @hypha/https-server.
The following example, taken from the initial scaffolding of Hypha, demonstrates how you can use @hypha/web-compiler in both development and production and alongside regular HTTPS and WebSocket routes (the latter demonstrated using the Express framework). As web-compiler uses server-sent events (SSE) for live reload, live reload will also work properly alongside your WebSocket routes.
You can checkout and run the initial Hypha scaffolding using the following commands:
git clone --branch 1.0.0 --single-branch https://source.ind.ie/hypha/hypha/
cd hypha
npm i && npm start
https://localhost
in a browser to see the client-side routes (a Choo app).https://locahost/https-get/
in a browser to hit the HTTPS GET route.Here is a simplified listing of the code from the Hypha scaffolding that you can use by adding whatever you like to client/index.js:
const httpsServer = require('@ind.ie/https-server')
const express = require('express')
const expressWebSocket = require('express-ws')
const path = require('path')
// Catch any uncaught errors.
process.on('uncaughtException', function (error) {
console.log('Uncaught exception:', error)
})
// Create the Express app, the HTTPS server, and add WebSocket support.
const app = express()
const server = httpsServer.createServer({}, app)
expressWebSocket(app, server, { perMessageDeflate: false })
//
// Websocket routes go here.
//
app.ws('/echo', (webSocket, request) => {
webSocket.on('message', message => {
console.log('Got web socket request to echo ', message)
webSocket.send(message)
})
})
//
// Regular HTTPS routes go here.
//
app.get('/https-get', (request, response) => {
response.writeHeader(200, {'Content-Type': 'text/html'})
response.end('<!doctype html><html lang=\'en\'><head><meta charset=\'utf-8\'/><title>Hello</title><style>body{background-color: white; font-family: sans-serif;}</style></head><body><h1>Hypha</h1><p>Hello, I am a dynamically-served HTTPS GET route.</p></body></html>')
})
//
// Set up @hypha/web-compiler.
//
// In development, we use it as middleware to enable live compilation and live reload.
// In production, use build a static distribution and serve it with express.static.
//
// client/index.js is the entry-point of your client-side JavaScript (e.g., a Choo app).
const entryPoint = path.join(__dirname, 'client/index.js')
if (process.env.NODE_ENV === 'production') {
// Build the static distribution and serve it in production.
const build = require('@hypha/web-compiler/lib/cmd-build')
build(entryPoint, null, {base: 'https://localhost'})
app.use(express.static('client/dist'))
} else {
// Set up development mode with live compilation and reload.
const webCompilerMiddleware = require('@hypha/web-compiler/http')(entryPoint)
app.use(webCompilerMiddleware)
webCompilerMiddleware.compiler.on('error', (nodeName, edgeName, error) => {
console.log(' ⚙ [web-compiler] Error:', nodeName, edgeName, error)
})
webCompilerMiddleware.compiler.on('change', function (nodeName, edgeName, nodeState) {
const name = nodeName + ':' + edgeName
console.log(' ⚙ [web-compiler]', name)
})
webCompilerMiddleware.compiler.on('ssr', function (result) {
console.log(' ⚙ [web compiler] SSR:', result.success ? 'success' : 'fail')
})
}
// Handle server errors.
app.use(function(error, request, response, next) {
console.log('Server Error', error)
response.send(500)
})
// Start the server.
server.listen(443, () => {
console.log('Server running on port 443.\n')
})
For further information, please see the pre-fork Bankai documentation.
For license compatibility information, see GPL-compatibility.
1: There is a command-line binary but, while it is functional, it is not used in Hypha except to gaze upon the beautiful output of the inspect command, which visualises project/component sizes in the browser:
web-compiler inspect
FAQs
A web compiler forked from Bankai and tuned for Hypha.
We found that @hypha/web-compiler demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.