
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@winfe/cli-plugin-add
Advanced tools
在现有的项目中安装物料,请参考[技术方案文档](https://www.yuque.com/srmcc5/hrthg3/an7gty)
在现有的项目中安装物料,请参考技术方案文档
根据物料的技术方案可以看到,目前把物料分为业务组件、区块和页面,使用的形式也不相同,且物料信息由 @winfe/get-materials 提供,所以 winex-cli 提供了 add 命令来帮助开发者安装和使用物料。
关于物料的详细信息,请参考物料开发模板
$ winex add --plugin <plugin> --pm [pm]
$ winex add --plugin components-name
1.从 @winfe/get-materials 查找,获取元数据
2.执行 npm/cnpm/yarn install components-name -save
$ winex add --plugin block-name
1.从 @winfe/get-materials 查找,获取元数据
2.确定区块或者页面的存放路径
3.是否需要安装区块或者页面所依赖的 dependencies
如果安装的依赖检测到跟现有的项目依赖有主版本的差异,则会给出提示信息
| 选项名称(option) | 缩写 | 选项说明 | 可选值 |
|---|---|---|---|
| --plugin | -p | 物料包名称 | - |
| --pm | -pm | 设置node包管理工具 | yarn(默认)/npm/cnpm |
FAQs
在现有的项目中安装物料,请参考[技术方案文档](https://www.yuque.com/srmcc5/hrthg3/an7gty)
We found that @winfe/cli-plugin-add demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.