
Research
/Security News
Shai Hulud Strikes Again (v2)
Another wave of Shai-Hulud campaign has hit npm with more than 500 packages and 700+ versions affected.
@rollup/plugin-auto-install
Advanced tools
Automatically install dependencies that are imported by a bundle
🍣 A Rollup plugin which automatically installs dependencies that are imported by a bundle, even if not yet in package.json.
This plugin requires an LTS Node version (v14.0.0+) and Rollup v1.20.0+.
Using npm:
npm install @rollup/plugin-auto-install --save-dev
Create a rollup.config.js configuration file and import the plugin:
import auto from '@rollup/plugin-auto-install';
import resolve from '@rollup/plugin-node-resolve';
export default {
input: 'src/index.js',
output: {
dir: 'output',
format: 'cjs'
},
plugins: [auto(), resolve()]
};
Note: ensure that this plugin is added to the plugins array before @rollup/plugin-node-resolve.
Then call rollup either via the CLI or the API.
pkgFileType: String
Default: '{cwd}/package.json'
Specifies the location on disk of the target package.json file. If the file doesn't exist, it will be created by the plugin, as package managers need to populate the dependencies property.
managerType: 'pnpm'|'yarn'|'npm'
Default: determined at runtime
Specifies the package manager to use. If not specified:
'pnpm' if pnpm-lock.yaml exists'yarn' if yarn.lock exists'npm' otherwiseThanks to Guillermo Rauch for the idea.
FAQs
Automatically install dependencies that are imported by a bundle
The npm package @rollup/plugin-auto-install receives a total of 150 weekly downloads. As such, @rollup/plugin-auto-install popularity was classified as not popular.
We found that @rollup/plugin-auto-install demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Another wave of Shai-Hulud campaign has hit npm with more than 500 packages and 700+ versions affected.

Product
Add real-time Socket webhook events to your workflows to automatically receive software supply chain alert changes in real time.

Security News
ENISA has become a CVE Program Root, giving the EU a central authority for coordinating vulnerability reporting, disclosure, and cross-border response.