
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@marko/serve
Advanced tools
When you serve a directory, every .marko file in that directory becomes a page. A browser is automatically launched and live-reloads as you make changes. It's the simplicity of a static file server plus the power of the Marko UI language.
/blog/:id)And when you build your production-ready app:
Start by creating and entering a new directory, then serve it using npx (requires npm 5.2.0+):
mkdir my-new-app
cd my-new-app/
npx @marko/serve .
By running npx @marko/serve, a browser tab automatically opens for the current working directory. Since our new directory is empty, you should see an empty directory index:

Let's make a web page! Create a hello.marko file within my-new-app/ with the following:
<h1>Hello World</h1>
Once you save this file, the directory index will reload and show hello.marko as a file:

Follow the hello.marko hyperlink to view your new page:

Navigate back to the directory index. Let's create an index.marko file with the following:
<h1>Home</h1>
Once you save this file, the directory index will reload and show our custom index instead:

Let's add a menu so we can navigate between our pages. Since it’ll be on every page, we'll create it as a component instead of duplicating code for each page.
components/ directory, then add a main-menu.marko file inside with the following:<nav>
<a href="/">Home</a>
-
<a href="/hello">Hello</a>
</nav>
Then, add the <main-menu> component to both pages:
<h1>Home</h1>
<main-menu/>
<h1>Hello World</h1>
<main-menu/>
We can now use the menu to navigate between pages!

What if we want our app to say "Hello" to more than the world? Do we need a new .marko file for each thing we want to say hello to?
Nope. This is where route parameters come in. Route parameters let you use dynamic values from the URL in your templates. Like normal pages, these are powered by your directory structure, but add a special syntax: filenames that contain keywords in square brackets (like [example]) create a parameter with the same name as the text between the brackets.
Rename hello.marko to hello/[name].marko, and update its contents to:
<h1>Hello ${input.params.name}</h1>
<main-menu/>
Try visiting http://localhost:3000/hello/params in your browser.

The possibilities are endless! Try adding a few to your menu:
<nav>
<a href="/">Home</a>
-
<a href="/hello/marko">Marko</a>
-
<a href="/hello/params">Params</a>
-
<a href="/hello/world">World</a>
</nav>
When you're ready to let the world see what you've built, run the build command to get a production-ready app:
npx @marko/build .
This produces a build/ directory that contains the app and its assets, all optimized and compressed.
We no longer need @marko/serve, @marko/build, or any other dependencies. We can run the server using only node:
node build/index.js
Open your browser to http://localhost:3000/ and you'll see the same app, only faster.

This build/ directory can now be deployed to your favorite hosting service. We're excited to see what you make! ✨
npm install --save-dev @marko/serve
marko-serve . # serve the current directory
marko-serve ./pages # serve a “pages” directory
marko-serve ./components/example.marko # serve a single component
marko-serve . --inspect-brk # debug by passing a node argument through
--port -p: The port to serve on (default 3000)--no-browser: Don't automatically open the browser--verbose: Show the entire raw build outputnode CLI arguments are passed to the Node.js server processWarning: Don't import the
@marko/servepackage directly yet. A programmatic API is coming soon.
FAQs
Utility to serve Marko files with a single command
We found that @marko/serve demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.