
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
@vue/component-compiler-utils
Advanced tools
Lower level utilities for compiling Vue single file components
The @vue/component-compiler-utils package is a lower-level utility for compiling Vue single-file components (SFCs). It is used by higher-level tools like vue-loader to process the various parts of a Vue component, such as the template, script, and styles. It provides functions to parse SFCs, compile their templates to render functions, and scope their styles.
Parsing Single-File Components
This feature allows you to parse .vue files into an object descriptor that contains separate objects for template, script, styles, and custom blocks.
const { parse } = require('@vue/component-compiler-utils');
const { readFileSync } = require('fs');
const source = readFileSync('MyComponent.vue', 'utf-8');
const descriptor = parse({
source,
filename: 'MyComponent.vue',
compiler: require('vue-template-compiler')
});
Compiling Template
This feature compiles the template part of a Vue component into a JavaScript render function.
const { compileTemplate } = require('@vue/component-compiler-utils');
const { descriptor } = require('./parsed-component');
const compiled = compileTemplate({
source: descriptor.template.content,
filename: 'MyComponent.vue',
compiler: require('vue-template-compiler')
});
Scoping Styles
This feature processes the styles of a Vue component, adding scope IDs to make them unique to the component, which helps in preventing style leakage.
const { compileStyle, compileStyleAsync } = require('@vue/component-compiler-utils');
const { descriptor } = require('./parsed-component');
const compiledStyle = compileStyle({
source: descriptor.styles[0].content,
filename: 'MyComponent.vue',
id: 'data-v-12345678',
scoped: true
});
This package is used to compile Vue 2.0 templates into render functions. It is often used in conjunction with @vue/component-compiler-utils but focuses solely on template compilation.
Vue-loader is a webpack loader that allows you to write Vue components in a format called Single-File Components (SFCs). It uses @vue/component-compiler-utils under the hood to process the various parts of a Vue component.
This is a Rollup plugin that integrates Vue SFC compilation into Rollup builds. Similar to vue-loader, it handles the processing of Vue components but is tailored for Rollup instead of webpack.
Lower level utilities for compiling Vue single file components
This package contains lower level utilities that you can use if you are writing a plugin / transform for a bundler or module system that compiles Vue single file components into JavaScript. It is used in vue-loader version 15 and above.
The API surface is intentionally minimal - the goal is to reuse as much as possible while being as flexible as possible.
Parse raw single file component source into a descriptor with source maps.
interface ParseOptions {
source: string
filename?: string
sourceRoot?: string
needMap?: boolean
}
interface SFCDescriptor {
template?: SFCBlock
script?: SFCBlock
styles: SFCBlock[]
customBlocks: SFCCustomBlock[]
}
interface SFCCustomBlock {
type: string
content: string
attrs: { [key: string]: string }
start: number
end: number
map: RawSourceMap
}
interface SFCBlock extends SFCCustomBlock {
lang?: string
src?: string
scoped?: boolean
module?: string | boolean
}
Takes raw template source and compile it into JavaScript code. The actual compiler (vue-template-compiler
) must be passed so that the specific version used can be determined by the end user.
It can also optionally perform pre-processing for any templating engine supported by consolidate.
interface TemplateCompileOptions {
source: string
filename: string
// See https://github.com/vuejs/vue/tree/dev/packages/vue-template-compiler
compiler: VueTemplateCompiler
compilerOptions?: VueTemplateCompilerOptions
// Template preprocessor
preprocessLang?: string
preprocessOptions?: any
// Transform asset urls found in the template into `require()` calls
// This is off by default. If set to true, the default value is
// {
// video: ['src', 'poster'],
// source: 'src',
// img: 'src',
// image: 'xlink:href'
// }
transformAssetUrls?: AssetURLOptions | boolean
// For vue-template-es2015-compiler, which is a fork of Buble
transpileOptions?: any
isProduction?: boolean // default: false
isFunctional?: boolean // default: false
optimizeSSR?: boolean // default: false
}
interface TemplateCompileResult {
code: string
source: string
tips: string[]
errors: string[]
}
interface AssetURLOptions {
[name: string]: string | string[]
}
The resulting JavaScript code will look like this:
var render = function (h) { /* ... */}
var staticRenderFns = [function (h) { /* ... */}, function (h) { /* ... */}]
It does NOT assume any module system. It is your responsibility to handle the exports, if needed.
Take input raw CSS and applies scoped CSS transform. It does NOT handle pre-processors. If the component doesn't use scoped CSS then this step can be skipped.
interface StyleCompileOptions {
source: string
filename: string
id: string
map?: any
scoped?: boolean
trim?: boolean
}
interface StyleCompileResults {
code: string
map: any | void
rawResult: LazyResult | void // raw lazy result from PostCSS
errors: string[]
}
FAQs
Lower level utilities for compiling Vue single file components
The npm package @vue/component-compiler-utils receives a total of 1,163,161 weekly downloads. As such, @vue/component-compiler-utils popularity was classified as popular.
We found that @vue/component-compiler-utils demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 19 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.