Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@rollup/plugin-replace
Advanced tools
The @rollup/plugin-replace npm package allows you to replace strings in files while bundling them with Rollup. This can be particularly useful for inserting environment variables, toggling between development and production modes, or any scenario where you need to dynamically alter your code at build time.
Environment Variable Replacement
This feature allows you to replace occurrences of 'process.env.NODE_ENV' with 'production' in your code. It's particularly useful for setting the environment mode.
import replace from '@rollup/plugin-replace';
export default {
plugins: [
replace({
'process.env.NODE_ENV': JSON.stringify('production')
})
]
};
Conditional Code Inclusion/Exclusion
This feature enables you to conditionally include or exclude code blocks based on the replacement. In this example, all blocks guarded by 'if (process.env.DEBUG)' will always execute as if the condition is true.
import replace from '@rollup/plugin-replace';
export default {
plugins: [
replace({
'if (process.env.DEBUG)': 'if (true)'
})
]
};
This Babel plugin allows you to replace specified nodes in your Babel AST with arbitrary values, similar to how @rollup/plugin-replace works. The difference lies in the approach: babel-plugin-transform-define operates on the AST level during the transpilation step, rather than during the bundling process.
🍣 A Rollup plugin which replaces targeted strings in files while bundling.
This plugin requires an LTS Node version (v14.0.0+) and Rollup v1.20.0+.
Using npm:
npm install @rollup/plugin-replace --save-dev
Create a rollup.config.js
configuration file and import the plugin:
import replace from '@rollup/plugin-replace';
export default {
input: 'src/index.js',
output: {
dir: 'output',
format: 'cjs'
},
plugins: [
replace({
'process.env.NODE_ENV': JSON.stringify('production'),
__buildDate__: () => JSON.stringify(new Date()),
__buildVersion: 15
})
]
};
Then call rollup
either via the CLI or the API.
The configuration above will replace every instance of process.env.NODE_ENV
with "production"
and __buildDate__
with the result of the given function in any file included in the build.
Note: Values must be either primitives (e.g. string, number) or function
that returns a string. For complex values, use JSON.stringify
. To replace a target with a value that will be evaluated as a string, set the value to a quoted string (e.g. "test"
) or use JSON.stringify
to preprocess the target string safely.
Typically, @rollup/plugin-replace
should be placed in plugins
before other plugins so that they may apply optimizations, such as dead code removal.
In addition to the properties and values specified for replacement, users may also specify the options below.
delimiters
Type: Array[String, String]
Default: ['\\b', '\\b(?!\\.)']
Specifies the boundaries around which strings will be replaced. By default, delimiters are word boundaries and also prevent replacements of instances with nested access. See Word Boundaries below for more information.
For example, if you pass typeof window
in values
to-be-replaced, then you could expect the following scenarios:
typeof window
will be replacedtypeof window.document
will not be replaced due to (?!\.)
boundarytypeof windowSmth
will not be replaced due to a \b
boundaryDelimiters will be used to build a Regexp
. To match special characters (any of .*+?^${}()|[]\
), be sure to escape them.
objectGuards
Type: Boolean
Default: false
When replacing dot-separated object properties like process.env.NODE_ENV
, will also replace typeof process
object guard
checks against the objects with the string "object"
.
For example:
replace({
values: {
'process.env.NODE_ENV': '"production"'
}
});
// Input
if (typeof process !== 'undefined' && process.env.NODE_ENV === 'production') {
console.log('production');
}
// Without `objectGuards`
if (typeof process !== 'undefined' && 'production' === 'production') {
console.log('production');
}
// With `objectGuards`
if ('object' !== 'undefined' && 'production' === 'production') {
console.log('production');
}
preventAssignment
Type: Boolean
Default: false
Prevents replacing strings where they are followed by a single equals sign. For example, where the plugin is called as follows:
replace({
values: {
'process.env.DEBUG': 'false'
}
});
Observe the following code:
// Input
process.env.DEBUG = false;
if (process.env.DEBUG == true) {
//
}
// Without `preventAssignment`
false = false; // this throws an error because false cannot be assigned to
if (false == true) {
//
}
// With `preventAssignment`
process.env.DEBUG = false;
if (false == true) {
//
}
exclude
Type: String
| Array[...String]
Default: null
A picomatch pattern, or array of patterns, which specifies the files in the build the plugin should ignore. By default no files are ignored.
include
Type: String
| Array[...String]
Default: null
A picomatch pattern, or array of patterns, which specifies the files in the build the plugin should operate on. By default all files are targeted.
sourceMap
or sourcemap
Type: Boolean
Default: false
Enables generating sourcemaps for the bundled code. For example, where the plugin is called as follows:
replace({
sourcemap: true
});
values
Type: { [key: String]: Replacement }
, where Replacement
is either a string or a function
that returns a string.
Default: {}
To avoid mixing replacement strings with the other options, you can specify replacements in the values
option. For example, the following signature:
replace({
include: ['src/**/*.js'],
changed: 'replaced'
});
Can be replaced with:
replace({
include: ['src/**/*.js'],
values: {
changed: 'replaced'
}
});
By default, values will only match if they are surrounded by word boundaries.
Consider the following options and build file:
module.exports = {
...
plugins: [replace({ changed: 'replaced' })]
};
// file.js
console.log('changed');
console.log('unchanged');
The result would be:
// file.js
console.log('replaced');
console.log('unchanged');
To ignore word boundaries and replace every instance of the string, wherever it may be, specify empty strings as delimiters:
export default {
...
plugins: [
replace({
changed: 'replaced',
delimiters: ['', '']
})
]
};
FAQs
Replace strings in files while bundling
The npm package @rollup/plugin-replace receives a total of 3,935,981 weekly downloads. As such, @rollup/plugin-replace popularity was classified as popular.
We found that @rollup/plugin-replace demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.