
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@openmfe/manifest
Advanced tools
The @openmfe/manifest tool retrieves and validates the contract of an OpenMFE microfrontend. It also resolves relative paths to full URLs. When you load a microfrontend’s manifest with this tool, you can be sure that the manifest complies with the OpenMFE specification.
The tool can be installed to any JavaScript project.
npm i @openmfe/manifest
Here’s how to run a manifest validation from the command line:
npx openmfe-validate http://localhost:8081/manifest/openmfe.yaml
You can also invoke it programmatically by loading it as a module (both ES and CommonJS are supported).
import getManifest from "@openmfe/manifest"
const url = "http://localhost:8081/manifest/openmfe.yaml"
const manifest = getManifest(url) // returns the validated manifest.
The contract history checker makes sure that a microfrontend’s contract doesn’t introduce breaking changes over time. This is important because a microfrontend is supposed to be always deployed under the same URL. Therefore, its consumers must be confident that attributes, events and other aspects of the interface do not change in a breaking way. For this purpose, the contract checker installs a small .contracts file in the project and checks if the manifest at a given URL breaks the contract for the given microfrontend.
npx openmfe-contract http://localhost:8081/manifest/openmfe.yaml
This can be done in the microfrontend project itself or in a consuming project. It can also manage multiple microfrontends at the same time. So, if you are maintaining a website that uses multiple microfrontends, it can keep track of all of them and notify you if something breaks.
FAQs
## Loading and Validation
The npm package @openmfe/manifest receives a total of 32 weekly downloads. As such, @openmfe/manifest popularity was classified as not popular.
We found that @openmfe/manifest demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.