
Research
/Security News
Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.
@rollup/plugin-yaml
Advanced tools
🍣 A Rollup plugin which Converts YAML files to ES6 modules.
This plugin requires an LTS Node version (v14.0.0+) and Rollup v1.20.0+.
Using npm:
npm install @rollup/plugin-yaml --save-dev
Create a rollup.config.js configuration file and import the plugin:
import yaml from '@rollup/plugin-yaml';
export default {
input: 'src/index.js',
output: {
dir: 'output',
format: 'cjs'
},
plugins: [yaml()]
};
Then call rollup either via the CLI or the API.
With an accompanying file src/index.js, the local heroes.yaml file would now be importable as seen below:
// src/index.js
import { batman } from './heroes.yaml';
console.log(`na na na na ${batman}`);
documentModeType: String
Default: single
If single, specifies that the target YAML documents contain only one document in the target file(s). If more than one document stream exists in the target YAML file(s), set documentMode: 'multi'.
excludeType: String | Array[...String]
Default: null
A picomatch pattern, or array of patterns, which specifies the files in the build the plugin should ignore. By default no files are ignored.
includeType: String | Array[...String]
Default: null
A picomatch pattern, or array of patterns, which specifies the files in the build the plugin should operate on. By default all files are targeted.
safeType: Boolean
Default: true
If true, specifies that the data in the target YAML file(s) contain trusted data and should be loaded normally. If false, data is assumed to be untrusted and will be loaded using safety methods.
transformType: Function
Default: undefined
A function which can optionally mutate parsed YAML. The function should return the mutated object, or undefined which will make no changes to the parsed YAML.
yaml({
transform(data, filePath) {
if (Array.isArray(data) && filePath === './my-file.yml') {
return data.filter((character) => !character.batman);
}
}
});
yaml-loader is a Webpack loader that allows you to import YAML files as JavaScript modules. It is similar to @rollup/plugin-yaml but is designed specifically for use with Webpack.
js-yaml is a standalone JavaScript library for parsing and dumping YAML. While it does not integrate directly with build tools like Rollup or Webpack, it can be used in conjunction with custom plugins or loaders to achieve similar functionality.
rollup-plugin-json is a Rollup plugin that allows you to import JSON files as JavaScript modules. While it is not specifically for YAML, it provides similar functionality for JSON files and can be used alongside @rollup/plugin-yaml for projects that use both JSON and YAML.
FAQs
Convert YAML files to ES6 modules
We found that @rollup/plugin-yaml demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.