
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
@metalsmith/js-bundle
Advanced tools
A metalsmith plugin that bundles your JS using esbuild with sensible defaults (and babel for ES5)
NPM:
npm install @metalsmith/js-bundle
Yarn:
yarn add @metalsmith/js-bundle
Pass @metalsmith/js-bundle to metalsmith.use :
import jsBundle from '@metalsmith/js-bundle'
metalsmith.use(
jsBundle({
// defaults
entries: {
index: 'lib/index.js'
}
})
)
const isProd = metalsmith.env('NODE_ENV') !== 'development'
metalsmith.use(
jsBundle({
// explicit defaults
bundle: true,
minify: isProd,
sourcemap: !isProd,
platform: 'browser',
target: 'es6',
assetNames: '[dir]/[name]',
// accessible as process.env.<NAME> in your JS files
define: metalsmith.env(),
// removes console & debugger statements
drop: isProd ? ['console', 'debugger'] : [],
entries: {
index: 'lib/index.js'
}
})
)
The key of the entries option determines the location of the processed file. For example index: 'lib/index.js' will result in /index.js, while '/assets/index': 'lib/index.js' will result in `/assets/index.js'.
The paths in the entries option should be relative to metalsmith.directory().
@metalsmith/js-bundle provides access to most underlying esbuild options, with a few notable differences:
The options absWorkingDir (=metalsmith.directory()), outdir (=metalsmith.destination()), write (=false), and metafile (=true) can not be set, they are determined by the plugin.
The option entryPoints is renamed to entries. Specify entries as a {'target': 'path/to/source.js' }} object, and mind that the target should not have an extension.
The option define is automatically filled with metalsmith.env(), but can be overwritten if desired. metalsmith.env('DEBUG') would be accessible in the bundle as process.env.DEBUG.
You can load assets with any of the ESbuild loaders by specifying a loader map. By default there is support for .js,.ts,.css,.json,.jsx,.tsx, and .txt loading. It's important to note 2 things:
file loader will be "embedded" in the resulting JS bundle and removed from the build (=not available for other plugins), increasing bundle size.file loader with other metalsmith plugins (eg metalsmith-imagemin)
@metalsmith/js-bundle needs to be run first and you should not overwrite the default assetNames option [dir]/[name].The file loader is the loader you need for most large asset types you wouldn't want to bloat your JS bundle with.
If you want to use inline SVG's, you would set its loader to text, while if you prefer loading them in image tags, you could set them to dataurl (embedded) or file (external).
The publicPath option will prepend a path to each asset loaded with the file loader. This can be useful if you are serving the metalsmith build from a non-root URI.
metalsmith.use(
jsbundle({
entries: { index: 'src/index.js' },
loader: {
'.png': 'file',
'.svg': 'dataurl',
'.jpg': 'file', // this will be a relative URI
'.yaml': 'text' // this will be a parseable string
},
publicPath: metalsmith.env('NODE_ENV') === 'development' ? '' : 'https://johndoe.com'
})
)
ESbuild does not support compiling to ES5 (ie. supporting IE 11 and some older mobile browsers).
Nevertheless you can specify the target: 'es5' option and @metalsmith/js-bundle will let ESbuild handle bundling and fall back on Babel to provide a compatibility layer. The side effects of this are a slower and bigger build and currently, no support for source maps. However, you can make the target depend on an environment variable and enjoy sourcemaps in development, eg:
const isDev = process.env.NODE_ENV === 'development'
metalsmith.use(
jsbundle({
entries: { index: 'src/index.js' },
target: isDev ? 'es6' : 'es5'
})
)
At the moment, passing options to Babel is not supported. A Babel production build will have basic minification, but without further (mangling) optimizations. You could choose to use metalsmith-uglifyjs to further optimize it.
Alternatively you could run @metalsmith/jsbundle twice, 1 with target es5, and 1 with higher, and decide with an inline script at run-time which bundle to inject.
To enable debug logs, set metalsmith.env('DEBUG', '@metalsmith/js-bundle*') or in metalsmith.json: "env": { "DEBUG": "@metalsmith/js-bundle*" }.
You can also pass the live environment variable by running metalsmith.env('DEBUG', process.env.DEBUG) or in metalsmith.json: "env": { "DEBUG": "$DEBUG" }
Alternatively you can set DEBUG to @metalsmith/* to debug all Metalsmith core plugins.
To use this plugin with the Metalsmith CLI, add @metalsmith/js-bundle to the plugins key in your metalsmith.json file:
{
"plugins": [
{
"@metalsmith/js-bundle": {
"entries": {
"app": "lib/main.js"
}
}
}
]
}
FAQs
A metalsmith plugin that bundles your JS using esbuild
We found that @metalsmith/js-bundle demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.