Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@juanger/worker-loader
Advanced tools
worker loader module for webpack
To begin, you'll need to install worker-loader
:
$ npm install worker-loader --save-dev
App.js
import Worker from 'worker-loader!./Worker.js';
webpack.config.js
module.exports = {
module: {
rules: [
{
test: /\.worker\.js$/,
use: { loader: 'worker-loader' },
},
],
},
};
App.js
import Worker from './file.worker.js';
const worker = new Worker();
worker.postMessage({ a: 1 });
worker.onmessage = function (event) {};
worker.addEventListener('message', function (event) {});
And run webpack
via your preferred method.
fallback
Type: Boolean
Default: false
Require a fallback for non-worker supporting environments.
webpack.config.js
module.exports = {
module: {
rules: [
{
test: /\.worker\.js$/,
use: { loader: 'worker-loader' },
options: { fallback: true },
},
],
},
};
inline
Type: Boolean
Default: false
You can also inline the worker as a BLOB with the inline
parameter.
webpack.config.js
module.exports = {
module: {
rules: [
{
test: /\.worker\.js$/,
use: { loader: 'worker-loader' },
options: { inline: true },
},
],
},
};
Note: Inline mode will also create chunks for browsers without support for inline workers, to disable this behavior just set fallback
parameter as false
.
webpack.config.js
module.exports = {
module: {
rules: [
{
loader: 'worker-loader',
options: { inline: true, fallback: false },
},
],
},
};
name
Type: String
Default: [hash].worker.js
To set a custom name for the output script, use the name
parameter.
The name may contain the string [hash]
, which will be replaced with a content dependent hash for caching purposes.
When using name
alone [hash]
is omitted.
webpack.config.js
module.exports = {
module: {
rules: [
{
loader: 'worker-loader',
options: { name: 'WorkerName.[hash].js' },
},
],
},
};
Type: String
Default: null
Overrides the path from which worker scripts are downloaded. If not specified, the same public path used for other webpack assets is used.
webpack.config.js
module.exports = {
module: {
rules: [
{
loader: 'worker-loader',
options: { publicPath: '/scripts/workers/' },
},
],
},
};
Type: string
Default: Worker
Set the worker type. Defaults to Worker
. Supports ServiceWorker
, SharedWorker
.
The worker file can import dependencies just like any other file:
Worker.js
const _ = require('lodash');
const obj = { foo: 'foo' };
_.has(obj, 'foo');
// Post data to parent thread
self.postMessage({ foo: 'foo' });
// Respond to message from parent thread
self.addEventListener('message', (event) => console.log(event));
Note: You can even use ES2015 Modules if you have the babel-loader
configured.
Worker.js
import _ from 'lodash';
const obj = { foo: 'foo' };
_.has(obj, 'foo');
// Post data to parent thread
self.postMessage({ foo: 'foo' });
// Respond to message from parent thread
self.addEventListener('message', (event) => console.log(event));
To integrate with TypeScript, you will need to define a custom module for the exports of your worker
typings/worker-loader.d.ts
declare module 'worker-loader!*' {
class WebpackWorker extends Worker {
constructor();
}
export default WebpackWorker;
}
Worker.ts
const ctx: Worker = self as any;
// Post data to parent thread
ctx.postMessage({ foo: 'foo' });
// Respond to message from parent thread
ctx.addEventListener('message', (event) => console.log(event));
App.ts
import Worker from 'worker-loader!./Worker';
const worker = new Worker();
worker.postMessage({ a: 1 });
worker.onmessage = (event) => {};
worker.addEventListener('message', (event) => {});
WebWorkers
are restricted by a same-origin policy, so if your webpack
assets are not being served from the same origin as your application, their download may be blocked by your browser.
This scenario can commonly occur if you are hosting your assets under a CDN domain.
Even downloads from the webpack-dev-server
could be blocked.
There are two workarounds:
Firstly, you can inline the worker as a blob instead of downloading it as an external script via the inline
parameter
App.js
import Worker from './file.worker.js';
webpack.config.js
module.exports = {
module: {
rules: [
{
loader: 'worker-loader',
options: { inline: true },
},
],
},
};
Secondly, you may override the base download URL for your worker script via the publicPath
option
App.js
// This will cause the worker to be downloaded from `/workers/file.worker.js`
import Worker from './file.worker.js';
webpack.config.js
module.exports = {
module: {
rules: [
{
loader: 'worker-loader',
options: { publicPath: '/workers/' },
},
],
},
};
Please take a moment to read our contributing guidelines if you haven't yet done so.
FAQs
worker loader module for webpack
The npm package @juanger/worker-loader receives a total of 0 weekly downloads. As such, @juanger/worker-loader popularity was classified as not popular.
We found that @juanger/worker-loader demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.