Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@rollup/plugin-multi-entry
Advanced tools
🍣 A Rollup plugin which allows use of multiple entry points for a bundle.
As an added bonus, the named exports from all entry points will be combined. This is particularly useful for tests, but can also be used to package a library.
Note: default
exports cannot be combined and exported by this plugin. Only named exports will be exported.
This plugin requires an LTS Node version (v14.0.0+) and Rollup v1.20.0+.
Using npm:
npm install @rollup/plugin-multi-entry --save-dev
Suppose that we have three separate source files, each with their own export(s):
// batman.js
export const belt = 'utility';
// robin.js
export const tights = 'tight';
// joker.js
export const color = 'purple';
Then, create a rollup.config.js
configuration file and import the plugin:
import multi from '@rollup/plugin-multi-entry';
export default {
input: ['batman.js', 'robin.js', 'joker.js'],
output: {
dir: 'output'
},
plugins: [multi()]
};
Then call rollup
either via the CLI or the API.
Using all three files above as entry points will yield a bundle with exports for belt
, tights
, and color
.
exports
Type: Boolean
Default: true
If true
, instructs the plugin to export named exports to the bundle from all entries. If false
, the plugin will not export any entry exports to the bundle. This can be useful when wanting to combine code from multiple entry files, but not necessarily to export each entry file's exports.
entryFileName
Type: String
Default: 'multi-entry.js'
entryFileName
changes the name of the generated entry file. By default, it will override outputOptions.entryFileNames
to be 'multi-entry.js'
.
preserveModules
Type: Boolean
Default: false
preserveModules
is to be used in conjunction with output.preserveModules
. If true
, overrides the entryFileName
option to be output.entryFileNames. If false
, the plugin will respect the entryFileName
option.
This plugin extends Rollup's input
option to support multiple new value types, in addition to a String
specifying a path to a file.
When using plugin-multi-entry
, input values passed as a normal String
are glob aware. Meaning you can utilize glob wildcards and other glob patterns to specify files as being input files.
export default {
input: 'batcave/friends/**/*.js',
plugins: [multi()]
// ...
};
An Array
of String
can be passed as the input. Values are glob-aware and can specify paths or globbed paths.
export default {
input: ['party/supplies.js', 'batcave/friends/**/*.js'],
plugins: [multi()]
// ...
};
include
and exclude
For fine-grain control, an Object
may be passed containing include
and exclude
properties. These properties specify and Array
of String
representing paths (which are also glob-aware) which should be included as entry files, as well as files that should be excluded from any entries that may have been found with include
, respectively.
export default {
input: {
// invite everyone!
include: ['food.js', 'drinks.js', 'batcave/friends/**/*.js'],
// except for the joker
exclude: ['**/joker.js']
},
plugins: [multi()]
// ...
};
FAQs
Use multiple entry points for a bundle
We found that @rollup/plugin-multi-entry demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.