Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@onflow/fcl-bundle
Advanced tools
FCL-Bundle is a module bundler used internally by FCL which aims to be low configuration and consistent across the monorepo. FCL-Bundle uses rollup and generates cjs, esm, and umd formats of the bundled modules.
Usage: fcl-bundle [options]
Options:
-V, --version output the version number
-w, --watch Run the build in watch mode
-h, --help display help for command
All of the configuration for FCL-Bundle currently takes place within the package.json
of the modules which you wish to bundle. The following configuration options are available:
Key | Required | Value Type | Description |
---|---|---|---|
source | Yes | string | Specify a source file entry point or an dictionary of Output Configuration objects keyed by respective source files (for multiple builds) - see Source Configuration for more details |
main | No | string | Specify cjs bundle output path if not manually specified by Output Configuration (as well as cjs entry point if not overridden by package.exports ) |
module | No | string | Specify esm bundle output path if not manually specified by Output Configuration (as well as esm entry point if not overriden by package.exports ) |
unpkg | No | string | Specify umd bundle output path if not manually specified by Output Configuration (as well as umd entry point if not overriden by package.exports ) |
Note: If output paths end in ".min.js", the resulting bundle will be minified
An Output Configuration object exists with the following properties:
Key | Required | Value Type | Description |
---|---|---|---|
cjs | No | string | Path of the cjs output bundle |
esm | No | string | Path of the esm output bundle |
umd | No | string | Path of the umd output bundle |
banner | No | string | Either a string representing a banner to be prepended to all output bundles for this build or a Banner Configuration object |
An empty Output Configuration will fallback to the default outputs if none are provided. However, if at least one output format is provided, the missing outputs will be excluded from the final build.
In practice, these Output Configuration objects will be consumed as shown in the Source Configuration below.
Note: If output paths end in ".min.js", the resulting bundle will be minified
A source configuration can be provided in one of three ways:
A string
identifying the path to the entry source file. Build outputs will be inferred from either the root level main
, module
, and unpkg
fields or from the default outputs if none are provided.
{
...
"source": "./src/index.js",
}
An array of entry source files. Build outputs will be inferred from the default outputs.
{
...
"source": [
"./src/indexA.js",
"./src/indexB.js"
]
}
A dictionary of Output Configuration objects keyed by respective source files.
{
...
"source": {
"./src/indexA.js": {
"cjs": "./dist/indexA.js"
},
"./src/indexB.js": {
"cjs": "./dist/indexB.js",
"esm": "./dist/indexB.module.js"
},
"./src/indexC.js": {
"cjs": "./dist/indexC.js",
"esm": "./dist/indexC.module.js",
"umd": "./dist/indexC.umd.js"
}
}
}
Note: if no output bundles (cjs,esm,umd) are specifified in either the root of package.json (main
, module
, unpkg
) or an Output Configuration object, the bundler will produce the following defaults:
cjs
-> dist/${basename(entry)}.js
esm
-> dist/${basename(entry)}.module.js
umd
-> dist/${basename(entry)}.umd.js
Key | Required | Value Type | Description |
---|---|---|---|
banner | Yes | string | Text to be displayed in banner |
raw | No | boolean | If false, wraps the banner in JS comment, if true no extra formatting is applied to banner (default false) |
PACKAGE_CURRENT_VERSION
in bundled code with the current version
of the package being bundled from package.json
@babel/preset-env
and babel rollup pluginFAQs
FCL Bundler Tool
We found that @onflow/fcl-bundle demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 12 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.