Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
@namecheap/wrapper-webpack-plugin
Advanced tools
Wraps output files (chunks) with custom text or code.
Install locally using npm:
npm i wrapper-webpack-plugin
Version 2 of this plugin only works with webpack >=4.
For webpack <4 use version 1 of the plugin with npm i -D wrapper-webpack-plugin@1
The WrapperPlugin
class has a single parameter, an object with a header
and/or footer
properties. Header text will
be prepended to the output file, footer text will be appended. These can be either a string or a function. A string
will simply be a appended/prepended to the file output. A function is expected to return a string, and will receive the
name of the output file as an argument.
An optional test
property (a string or a RegExp
object) can control which output files are affected; otherwise all output files will be wrapped.
New in 2.1:
The optional afterOptimization
property can be used to avoid having the added text affected by the optimization stage, e.g. if you don't want it to be minified.
function WrapperPlugin({
test: string | RegExp,
header: string | function,
footer: string | function,
afterOptimization: bool // default: false
})
Wraps bundle files with '.js' extension in a self invoking function and enables strict mode:
const WrapperPlugin = require('wrapper-webpack-plugin');
module.exports = {
// other webpack config here
plugins: [
// strict mode for the whole bundle
new WrapperPlugin({
test: /\.js$/, // only wrap output of bundle files with '.js' extension
header: '(function () { "use strict";\n',
footer: '\n})();'
})
]
};
Prepends bundles with a doc comment:
const WrapperPlugin = require('wrapper-webpack-plugin');
module.exports = {
// other webpack config here
plugins: [
new WrapperPlugin({
header: function (fileName) {
return '/*! file: ' + fileName + ', created by dev123 */\n';
}
})
]
};
Accessing file name, build hash, and chunk hash at runtime.
const WrapperPlugin = require('wrapper-webpack-plugin');
module.exports = {
// other webpack config here
output: {
filename: '[name].[chunkhash].js'
},
plugins: [
new WrapperPlugin({
header: `(function (FILE_NAME, BUILD_HASH, CHUNK_HASH) {`,
footer(fileName, args) {
return `})('${fileName}', '${args.hash}', '${args.chunkhash}');`;
// note: args.hash and args.chunkhash correspond to the [hash] and [chunkhash]
// placeholders you can specify in the output.filename option.
}
})
]
};
Keeping header in a separate file:
file: header.js
/*!
* my awesome app!
*/
file: webpack.config
const fs = require('fs');
WrapperPlugin = require('wrapper-webpack-plugin');
const headerDoc = fs.readFileSync('./header.js', 'utf8');
module.exports = {
// other webpack config here
plugins: [
new WrapperPlugin({
header: headerDoc
})
]
};
A slightly more complex example using lodash
templates:
const WrapperPlugin = require('wrapper-webpack-plugin');
const template = require('lodash.template');
const pkg = require('./package.json');
const tpl = '/*! <%= name %> v<%= version %> | <%= author %> */\n';
module.exports = {
// other webpack config here
plugins: [
new WrapperPlugin({
header: template(tpl)(pkg)
})
]
};
This plugin should play nicely with most other plugins.
E.g. adding the webpack.optimize.UglifyJsPlugin
plugin to the plugins array after the WrapperPlugin
will result in
the wrapper text also being minified.
FAQs
Wraps output files (chunks) with custom text or code.
We found that @namecheap/wrapper-webpack-plugin demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.