
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@we-weaver/cli
Advanced tools
yarn global add @we-weaver/cli
or
npm install @we-weaver/cli -g
安装成功后使用改命令初始化配置
weaver config --init
输入 OA 帐号密码即可
weaver login
tip:初始化时输入组件的名称即可,组件的类型会在创建成功后修改 例如 weaver init sidebar,选择业务组件,将会生成 basic-component-sidebar 目录,如果目录名称有误(没有正确的包含组件的类型),请手动调整名称。
weaver init [组件或场景名称]
组件上传的标准是当前目录下存在
package.json文件.
weaver upload [目标目录或者当前目录]
内置 (Bili)[https://bili.egoist.sh/#/] 打包工具
weaver build <entry> [type=jsx|vue]
内置 (Poi)[https://poi.js.org/] 调试工具
weaver dev [entry] --serve
如果需要调整调试或者打包配置, 在
package.json中新增 weaver 字段或者新增weaver.config.js文件
{
...
"weaver": {
// 上传配置
"upload": {
// 需要上传的目标仓库
"repository_id": 5247,
// 目标分支
"target_branch": "master",
// 上传需要忽略的文件或文件夹,会与 .gitignore 中的内容进行合并
"excludes": [
".vscode",
"node_modules",
".git",
".gitignore",
".DS_Store",
"dist",
"screenshots",
"yarn.lock",
"package.lock",
],
},
"buildConfig": {
// https://poi.js.org/config.html
},
"devConfig": {
// https://bili.egoist.sh/#/
}
}
}
FAQs
Cli tool for build we weaver
We found that @we-weaver/cli demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.