Security News
How Threat Actors are Abusing GitHub’s File Upload Feature to Host Malware
GitHub is susceptible to a CDN flaw that allows attackers to host malware on any public repository.
@tonysusi/vapid
Advanced tools
Readme
Vapid is an intentionally simple content management system built on the idea that you can create a custom dashboard without ever leaving the HTML.
Vapid requires node v10 or higher, and can be installed via npm
npm install -g @tonysusi/vapid
To create a new website project, use the Vapid command line tool:
vapid new path/to/project/folder
Then change to the project directory, and start the development server. By default, the server will livereload, and refresh your website as you change the source files.
cd path/to/project/folder
vapid start .
A few files and folders you should be aware of:
File/Folder | Description |
---|---|
www | Your website files. Anything you put in here is an accessible resource, with the exceptions of files that start with underscores or periods—those are private/special. Sass and JS files that have the .pack.js , .pack.scss , or .pack.sass extensions will be compiled by Webpack. |
data | SQLite database file, and uploaded images. In general, you do not want to mess with this folder. |
node_modules | This one should also be ignored. |
package.json | Information about your project, including Vapid configuration options. |
.env | A private file that contains server environment variables, like the SECRET_KEY used by the web server. |
Vapid can be deployed to any hosting service that supports Node.js. Here are a few to consider:
Service | Notes |
---|---|
Heroku | Free or paid tiers. One thing to note is that Heroku's file system is ephemeral, so Vapid's type=image directives won't work here. |
Glitch | The easiest way to take Vapid for a test-drive. |
Or, use the vapid build
command to export to a static website, and host on S3, Surge, or the like.
If you'd like to get involved, and help improve Vapid:
FAQs
A template-driven content management system
The npm package @tonysusi/vapid receives a total of 1 weekly downloads. As such, @tonysusi/vapid popularity was classified as not popular.
We found that @tonysusi/vapid demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
GitHub is susceptible to a CDN flaw that allows attackers to host malware on any public repository.
Security News
At Node Congress, Socket CEO Feross Aboukhadijeh uncovers the darker aspects of open source, where applications that rely heavily on third-party dependencies can be exploited in supply chain attacks.
Research
Security News
The Socket Research team found this npm package includes code for collecting sensitive developer information, including your operating system username, Git username, and Git email.