
Security News
Open VSX Begins Implementing Pre-Publish Security Checks After Repeated Supply Chain Incidents
Following multiple malicious extension incidents, Open VSX outlines new safeguards designed to catch risky uploads earlier.
@weareeight/armada-sync
Advanced tools
A tool to ease syncing theme files and resources on shopify deployment
A utility designed to retrieve and overwrite all template json files for patching a published themes settings to another theme.
This cli surfaces a utility armada-sync or full package @weareeight/armada-sync that takes arguments, finds the published theme, gets a list of files ( settings_data.json and all content in the /templates/ folder) then saves them to a specified path locally.
This is designed to be used in our CI flow, to patch the theme and then overwrite with user controlled data.
Notes:
In theme dev it would be best to install this pacakage either into the theme or install implicitly in the github action.
npm install @weareeight/armada-sync then access from npm scripts in package JSON
Alternately using NPX you can execute and install from latest using
npx --yes @weareeight/armada-sync --ARGS --GO --HERE
npx @weareeight/armada-sync --shop='something' --token='CustomApDevtoken' --themeFolder='./src/theme'
--shop='something' this is the store url WITHOUT myshopify.com ( it will try fix it )--token='CustomAppGeneratedKey' Generated through the admin (replaces private app auth)--themeFolder='./src/theme' optional defaults to ./src/theme--themeId='XX' NOT REQUIRED: will pull down from this specific theme ID
---useEnv optional switches the params to dotEnvIt is possible to use .env to replace all the arguments pass the cli --useEnv as a flag and add a .env or specify ENV VARS in your CI.
SHOPIFY_SHOP=shopdomain
SHOPIFY_TOKEN=ShopifyTokenGoesHere
# Optional / not required
SHOPIFY_THEME_FOLDER=./src/theme
SHOPIFY_THEME_ID=not-required
---------------------||||||||||-------------------
FAQs
A tool to ease syncing theme files and resources on shopify deployment
We found that @weareeight/armada-sync demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 10 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Following multiple malicious extension incidents, Open VSX outlines new safeguards designed to catch risky uploads earlier.

Research
/Security News
Threat actors compromised four oorzc Open VSX extensions with more than 22,000 downloads, pushing malicious versions that install a staged loader, evade Russian-locale systems, pull C2 from Solana memos, and steal macOS credentials and wallets.

Security News
Lodash 4.17.23 marks a security reset, with maintainers rebuilding governance and infrastructure to support long-term, sustainable maintenance.