
Research
6 Malicious Packagist Themes Ship Trojanized jQuery and FUNNULL Redirect Payloads
Six malicious Packagist packages posing as OphimCMS themes contain trojanized jQuery that exfiltrates URLs, injects ads, and loads FUNNULL-linked redirects.
@webflow/webflow-cli
Advanced tools
The Webflow CLI is a command-line interface that allows you to interact with various Webflow developer products, including Devlink and Designer Extensions.
The Webflow CLI is a command-line interface that allows you to interact with various Webflow developer products, including Devlink and Designer Extensions.
You can install the Webflow CLI globally on your machine using npm:
npm i @webflow/webflow-cli -g
Designer Extensions are single-page web Apps that run inside of of the Webflow Designer, and manipulate elements on the canvas through Webflow's Designer APIs.. You can use the Webflow CLI to develop and package your Designer Extensions.
To create a new extension, use the webflow extension init command:
webflow extension init my-extension
This command creates a new directory named my-extension with a basic scaffold for your extension. See more details about the scaffolding on the App structure reference.
Navigate to the newly created folder for your extension. You can serve your extension locally using the following command. The default port is set to 1337.
npm run dev
This will run the webflow extension serve and command, allowing you test your App locally.
port - Serve your extension at a specific port on localhost: webflow extension serve 1234If you're using the scaffolding built out from the webflow extension init command, you can create a build of your extension, an bundle it for publishing using the npm run build command:
npm run build
This will run the webflow extension bundle CLI command, which will output a bundle.zip file in your extension’s directory. You can upload this extension to Webflow via the "Integrations" tab in your workspace settings. Note: The extension size limit is 5MB.
DevLink allows you to visually design and build web components for React directly in Webflow. Learn more in our DevLink overview, and read the DevLink documentation.
npx webflow devlink -h
In order to use the DevLink CLI first you'll need to create a .webflowrc configuration file on your application's root directory.
The supported formats are JavaScript(.js) and JSON (.json).
It should look something like this:
JSON:
{
"host": "https://api.wfdev.io:8443",
"rootDir": "./devlink",
"siteId": "[YOUR SITE ID]",
"authToken": "[API TOKEN]"
}
JavaScript:
module.exports = {
host: "https://api.wfdev.io:8443",
rootDir: "./devlink",
siteId: "[YOUR SITE ID]",
authToken: process.env.WF_TOKEN,
};
You'll have to generate an API token to your application. This can be done on your Webflow project by going to Site Settings > Integrations.
npx webflow devlink sync
By using Webflow DevLink you agree to the Webflow Labs Terms of Service.
FAQs
The Webflow CLI is a command-line interface that allows you to interact with various Webflow developer products, including Devlink and Designer Extensions.
The npm package @webflow/webflow-cli receives a total of 8,255 weekly downloads. As such, @webflow/webflow-cli popularity was classified as popular.
We found that @webflow/webflow-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 12 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Six malicious Packagist packages posing as OphimCMS themes contain trojanized jQuery that exfiltrates URLs, injects ads, and loads FUNNULL-linked redirects.

Security News
The GCVE initiative operated by CIRCL has officially opened its publishing ecosystem, letting organizations issue and share vulnerability identifiers without routing through a central authority.

Security News
The project is retiring its odd/even release model in favor of a simpler annual cadence where every major version becomes LTS.