Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
@qooxdoo/compiler
Advanced tools
node.js based replacement for the Qooxdoo python toolchain
Qooxdoo-Compiler is the new compiler and command line interface for Qooxdoo (http://qooxdoo.org) applications, written in 100% Node.JS Javascript it adds these key improvements over the standard python generator:
One of the top goals of this project is to be very fast and lightweight - fast enough to detect code changes and recompile applications on the fly on a production server, with an application recompile costing a few hundreds of milliseconds.
The included command line utility allows you create, build and manage qooxdoo applications (note that Qooxdoo-Compiler now incorporates the Qooxdoo-CLI project, which used to be a separate repo).
Beta. The API has mostly stabilized, we will provide a migration path for any backward-incompatible changes.
Node Currently requires NodeJS >= v8. We recommend you consider nvm
to
ease installing and switching between node versions - you can find the Linux
version at http://nvm.sh and there is a version for Windows at
https://github.com/coreybutler/nvm-windows
Qooxdoo The compiler works with all qooxdoo versions >= v6.0.0, which is contained in the current master branch.
Install nvm
and then:
nvm install 8 # or 10
nvm use 8 # or 10
For more detailed information about installation and use of the compiler, refer to the documentation.
Here's how you can do a quick test drive using npx
which doesn't install anything
permanent
npx qx create myapp --noninteractive
cd myapp
npx qx package install qooxdoo/qxl.apiviewer
npx qx package install qooxdoo/qxl.widgetbrowser
npx qx serve
Wait for the message Web server started, please browse to http://localhost:8080
,
then open that address in the browser.
Qooxdoo Compiler is a BETA RELEASE and of course, you use at your own risk. However, it is in use in several major production applications maintained by the qooxdoo core developers and therefore you can be fairly confident that we cherish stability and every major bug that comes up will be fixed ASAP.
Number one gotcha is that you have to run the compiler every time you change
your code, because it's being transpiled. The qx compile
command has a
--watch
parameter that enables continuous compilation. Note that the qx serve
command always used continuous compilation.
config.json
is not used by QxCompiler; the qx
command is using a new, and much
simpler configuration file called compile.json
.
The path to the qooxdoo library does not need to be specified since the compiler
comes with its own copy of the framework, if this is not what you want, you can
use the CLI to set the path:
qx config set qx.libraryPath /path/to/qooxdoo/framework
The compiler is a full equivalent as far as compiling is concerned, and much
faster at that. However, its domain is compiling applications (including
collecting resources) whereas generate.py included features for building and
running test suites, creating API documentation, building distributions,
creating skeleton applications, etc. These features have not been replicated.
Instead, you can do all these things with code now in a file called compile.js
Please get stuck in to any aspects you'd like to work on - We're open to pull requests, and you can contact us to chat about features you'd like to see or help on using or extending Qooxdoo-Compiler. The best place to talk about it is on Gitter at https://gitter.im/qooxdoo/qooxdoo
FAQs
node.js based replacement for the Qooxdoo python toolchain
The npm package @qooxdoo/compiler receives a total of 115 weekly downloads. As such, @qooxdoo/compiler popularity was classified as not popular.
We found that @qooxdoo/compiler demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.