
Research
Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.
@nkalinov/mf-manifest-deployment-plugin
Advanced tools
Inspired by import-map-deployer,
this Webpack plugin will allow you to dynamically load remotes taking their URLs from a manifest JSON file deployed
remotely.
This decoupling allows you to switch between different versions much faster as you no longer have hardcoded remotes
URLs and you don't need to rebuild/redeploy to ship a new version. All you have to do is update the pointer in the
manifest file.
When paired with module-federation-manifest-deployment-override it unlocks great potential. It can improve your developer experience by allowing you to code within the production environment and point only specific micro-frontends to your local machine.
yarn add @nkalinov/mf-manifest-deployment-plugin
Change your remotes and add to webpack.config.js plugins:
const ModuleFederationDeploymentPlugin = require('@nkalinov/mf-manifest-deployment-plugin');
module.exports = {
plugins: [
new ModuleFederationPlugin({
remotes: {
'app1': 'manifest app1',
},
}),
new ModuleFederationDeploymentPlugin(options)
],
}
Defaults:
{
defaultEntryName = 'remoteEntry.js',
key = '__webpack_mf_deployment_manifest__',
manifestPath = '/manifest.json',
fallbackOrigin = '', // will inherit the public path origin
}
key - The window key that will be used to store the manifest.manifestPath - Relative path (with leading slash) from the current origin to the manifest.json file.fallbackOrigin - Origin that will be used for the fallback requests (defaults to public path origin). Could be
absolute or relative path prefixed with / (in which case public path origin will be used).fallbackEntryName - Remote entry filename that will be used for the fallback requests.new URL(__webpack_public_path__).origin + manifestPath${fallbackOrigin}/${name}/latest/${fallbackEntryName}'${fallbackOrigin}/${name}/latest/' + fileNametodo
FAQs
Unknown package
We found that @nkalinov/mf-manifest-deployment-plugin demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.

Product
Explore exportable charts for vulnerabilities, dependencies, and usage with Reports, Socket’s new extensible reporting framework.

Product
Socket for Jira lets teams turn alerts into Jira tickets with manual creation, automated ticketing rules, and two-way sync.