Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
@toptal/davinci-engine
Advanced tools
@toptal/davinci-engine
Starts and builds your project. Under the hood, it covers webpack with the default webpack configuration.
Use it by installing yarn add @toptal/davinci-engine
in your project.
start
: start a development server for the current Davinci projectbuild
: build the current Davinci projectsize
: check bundle sizeanalyze
: analyze bundle and check dependenciescompile-package
: compile the current project into a package directorypublish-package
: publish the current package directory to NPMsentry-upload-source-maps
: upload the project source maps to SentryWe filter environment variables to be sure that only needed variables are handled, so if you want to have variables passed, you need to
DAVINCI_
prefix. E.g. DAVINCI_PLATFORM_URL=http://localhost:3000
.env
file. davinci-engine
reads all variables from .env irrespective of DAVINCI_
prefix.
If --dotenv
argument set to auto
value, the variables are loaded from the environment-specific
files in the following order:
.env.[NODE_ENV].local
- for untracked, local overrides.env.[NODE_ENV]
.env
There is a global DAVINCI_RELEASE_VERSION
variable that you can use inside your application, it is a unique release tag that you can pass to Sentry or Rollbar to associate javascript errors with particular releases. It is passed down on release stage of deployment process. Please don't forget to provide default value for other environments.
You can learn more about setting up and configuring Davinci's reverse proxy here.
Davinci is using resolve-ts-aliases which proxies aliases in the project's tsconfig
go to the webpack config.
This package can be used directly in your IDE through these extensions
FAQs
Build tool for frontend projects
We found that @toptal/davinci-engine demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.