Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@salesforce/dev-scripts
Advanced tools
Standardize package.json scripts and config files for Salesforce projects.
A collection of commonly needed scripts and hooks used by Salesforce typescript projects. This helps to enforce consistency across and reduces the amount of time it takes to setup new projects. This also reduces the amount of needed configuration required for each project by using common configuration from @salesforce/dev-config by default.
When dev-scripts is added as a dev dependency, it will enforce the package.json has the right scripts, hooks, and dependencies. Use the .sfdevrc.json
to configure what is generated and controlled.
To automatically have dev-scripts enabled after install, edit package.json
:
// package.json
{
"scripts": {
"prepare": "sf-install"
}
}
The common scripts that are added to each project include:
all
to also clean node_modules
e.g. yarn clean
or yarn clean-all
yarn compile
yarn lint
yarn test
yarn build
yarn docs
The common hooks that are added to each project include:
yarn docs
.yarn build
.To configure what this generates and controls, create a .sfdevrc
file. Look at the schema to see what options are available.
By default, devScripts will try to keep your package.json aligned with its standards.
For example, devScripts will remove dependencies that it provides. If you want to keep yours, you'd add it in to the sfdevrc
. Imagine you need to be on a higher or lower version of mocha that devScripts provides:
{
"devDepOverrides": ["mocha", "@types/mocha"]
}
And it maintains the scripts
and wireit
properties. Imagine you want a different lint step in wireit, and a different test step:
{
"scripts": {
"test": "yarn test:nuts"
},
"wireit": {
"lint": {
"command": "eslint src test --color",
"files": ["src/**/*.ts", "test/**/*.ts", "messages/**", "**/.eslint*", "**/tsconfig.json"],
"output": []
}
}
}
The include
section has to live in the repository's tsconfig file until there is a way to specify a base. We plan to remove this section when https://github.com/Microsoft/TypeScript/issues/25430 is fixed
DevScripts has an action you can run which will run the devScripts action in lots of repos (they check for an update, and then bump the version, do an install, etc.)
This runs automatically after devScripts releases.
You need to maintain the list of repos here: https://github.com/forcedotcom/dev-scripts/blob/361bc49a6694fdd9c772031ac583e8a80f139a83/.github/workflows/cross-repo-bump.yml#L17
You can see the in-progress PRs using https://github.com/pulls?q=is%3Aopen+is%3Apr+archived%3Afalse+%22refactor%3A+devScripts+update%22
FAQs
Standardize package.json scripts and config files for Salesforce projects.
The npm package @salesforce/dev-scripts receives a total of 17,625 weekly downloads. As such, @salesforce/dev-scripts popularity was classified as popular.
We found that @salesforce/dev-scripts demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 47 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.