
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
@wordpress/build
Advanced tools
Build tool for WordPress plugins.
@wordpress/build is an opinionated build system designed for WordPress plugins. It provides:
build/) and ESM (build-module/) formats using esbuildnpm install @wordpress/build --save-dev
wp-build
or via npm script:
{
"scripts": {
"build": "wp-build"
}
}
wp-build --watch
or via npm script:
{
"scripts": {
"dev": "wp-build --watch"
}
}
Configure your package.json with the following optional fields:
wpScriptControls whether the package is exposed as a bundled WordPress script/module and accessible via the configured global variable.
true: The package will be bundled and exposed as a WordPress script. It will be available in WordPress as part of the configured global (e.g., wp.blockEditor, wp.data, or a custom global name if configured differently).
Omitted or false (default): The package will not be exposed as a WordPress script. Use this for packages designed solely as dependencies for other packages. The package can still be used as a dependency via npm imports by other packages.
{
"wpScript": true
}
For more details on when to omit or set this to false, see the package guidelines.
wpScriptModuleExportsDefine script module entry points:
{
"wpScriptModuleExports": {
"./interactivity": "./build-module/interactivity/index.js"
}
}
wpScriptDefaultExportHandle default export wrapping:
{
"wpScriptDefaultExport": true
}
wpScriptExtraDependenciesAdditional script dependencies:
{
"wpScriptExtraDependencies": ["wp-polyfill"]
}
wpStyleEntryPointsCustom SCSS entry point patterns:
{
"wpStyleEntryPoints": {
"style": "src/style.scss"
}
}
wpCopyFilesFiles to copy with optional PHP transformations:
{
"wpCopyFiles": [
{
"from": "src/index.php",
"to": "build/index.php",
"transform": "php"
}
]
}
Configure your root package.json with a wpPlugin object to control global namespace and externalization behavior:
wpPlugin.scriptGlobalThe global variable name for your packages (e.g., "wp", "myPlugin"). Set to false to disable global exposure:
{
"wpPlugin": {
"scriptGlobal": "myPlugin"
}
}
wpPlugin.packageNamespaceThe package scope to match for global exposure (without @ prefix). Only packages matching @{packageNamespace}/* will expose globals:
{
"wpPlugin": {
"scriptGlobal": "myPlugin",
"packageNamespace": "my-plugin"
}
}
wpPlugin.handlePrefixThe prefix used for WordPress script handles in .asset.php files (e.g., wp-data, my-plugin-editor). Defaults to packageNamespace:
{
"wpPlugin": {
"scriptGlobal": "myPlugin",
"packageNamespace": "my-plugin",
"handlePrefix": "mp"
}
}
With this configuration:
@my-plugin/editor → window.myPlugin.editor with handle mp-editor@my-plugin/data → window.myPlugin.data with handle mp-datawpPlugin.externalNamespacesAdditional package namespaces to externalize (consume as externals, not expose). Each namespace must be an object with global and optional handlePrefix:
{
"wpPlugin": {
"externalNamespaces": {
"woo": {
"global": "woo",
"handlePrefix": "woocommerce"
},
"acme": {
"global": "acme",
"handlePrefix": "acme-plugin"
}
}
}
}
This allows your packages to consume third-party dependencies as externals:
import { Cart } from '@woo/cart' → window.woo.cart with handle woocommerce-cartimport { Button } from '@acme/ui' → window.acme.ui with handle acme-plugin-ui.asset.php filesIf handlePrefix is omitted, it defaults to the namespace key (e.g., "woo" → woo-cart).
wpPlugin.pages (Experimental)Define admin pages that support routes. Each page gets generated PHP functions for route registration and can be extended by other plugins.
Pages can be defined as simple strings or as objects with initialization modules:
{
"wpPlugin": {
"pages": [
"my-admin-page",
{
"id": "my-other-page",
"init": ["@my-plugin/my-page-init"]
}
]
}
}
Page Configuration:
"my-admin-page" - Simple page with no init modules{ "id": "page-slug", "init": ["@scope/package"] } - Page with init modulesGenerated Files:
This generates two page modes:
build/pages/my-admin-page/page.php - Full-page mode (takes over entire admin screen with custom sidebar)build/pages/my-admin-page/page-wp-admin.php - WP-Admin mode (integrates within standard wp-admin interface)build/pages.php - Loader for all pagesEach mode provides route/menu registration functions and a render callback. Routes are automatically registered for both modes.
Registering a menu item for WP-Admin mode:
// Build URL with initial route via 'p' query parameter
$url = admin_url( 'admin.php?page=my-admin-page-wp-admin&p=' . urlencode( '/my/route' ) );
add_menu_page( 'Title', 'Menu', 'capability', $url, '', 'icon', 20 );
Registering a menu item for full-page mode:
add_menu_page( 'Title', 'Menu', 'capability', 'my-admin-page', 'my_admin_page_render_page', 'icon', 20 );
Init Modules: Init modules are JavaScript packages that execute during page initialization, before routes are registered and the app renders. They're ideal for:
Creating an Init Module:
In packages/my-page-init/package.json:
{
"name": "@my-plugin/my-page-init",
"wpScriptModuleExports": "./build-module/index.js",
"dependencies": {
"@wordpress/boot": "file:../boot",
"@wordpress/data": "file:../data",
"@wordpress/icons": "file:../icons"
}
}
In packages/my-page-init/src/index.ts:
import { home, styles } from '@wordpress/icons';
import { dispatch } from '@wordpress/data';
import { store as bootStore } from '@wordpress/boot';
/**
* Initialize page - this function is mandatory.
* All init modules must export an 'init' function.
*/
export async function init() {
// Add icons to menu items
dispatch( bootStore ).updateMenuItem( 'home', { icon: home } );
dispatch( bootStore ).updateMenuItem( 'styles', { icon: styles } );
}
The init() function is mandatory - all init modules must export this named function. Init modules are loaded as static dependencies and executed sequentially before the boot system registers menu items and routes.
{
"wpPlugin": {
"scriptGlobal": "wp",
"packageNamespace": "wordpress"
}
}
This configuration:
@wordpress/data expose window.wp.data@wordpress/block-editor expose window.wp.blockEditor@wordpress/* as externals{
"wpPlugin": {
"scriptGlobal": "acme",
"packageNamespace": "acme"
}
}
This configuration:
@acme/editor expose window.acme.editor@acme/data expose window.acme.data@wordpress/* → window.wp.*window.React, window.lodashwpScript: true matching the namespace: Bundled with global exposurewpScript: true not matching the namespace: Bundled without global exposure@wordpress/* packages are always externalized to wp.* globals.asset.php files are always generated for WordPress dependency managementThe built tool generates several files in the build/ directory, but the primary output is the PHP registration file.
Make sure to include the generated PHP file in your plugin file.
require_once plugin_dir_path( __FILE__ ) . 'build/index.php';
Routes provide a file-based routing system for WordPress admin pages. Each route must be associated with a page defined in wpPlugin.pages (see above). Create a routes/ directory at your repository root with subdirectories for each route.
routes/
home/
package.json # Route configuration
stage.tsx # Main content component
inspector.tsx # Optional sidebar component
canvas.tsx # Optional custom canvas component
route.tsx # Optional lifecycle hooks (beforeLoad, loader, canvas)
In routes/{route-name}/package.json:
{
"route": {
"path": "/",
"page": "my-admin-page"
}
}
The page field must match one of the pages defined in wpPlugin.pages in your root package.json. This tells the build system which page this route belongs to. It can also map to an existing page registered by another plugin.
stage.tsx - Main content (required):
export const stage = () => <div>Content</div>;
inspector.tsx - Sidebar content (optional):
export const inspector = () => <div>Inspector</div>;
canvas.tsx - Custom canvas component (optional):
export const canvas = () => <div>Custom Canvas</div>;
The canvas is a full-screen area typically used for editor previews. You can provide a custom canvas component that will be conditionally rendered based on the canvas() function's return value in route.tsx.
route.tsx - Lifecycle hooks (optional):
export const route = {
beforeLoad: ({ params, search }) => {
// Pre-navigation validation, auth checks
},
loader: ({ params, search }) => {
// Data preloading
},
canvas: ({ params, search }) => {
// Return CanvasData to use default canvas (editor)
return {
postType: 'post',
postId: '123',
isPreview: true
};
// Return null to use custom canvas.tsx component
// return null;
// Return undefined to show no canvas
// return undefined;
}
};
The canvas() function controls which canvas is rendered:
CanvasData object ({ postType, postId, isPreview? }) → Renders the default WordPress editor canvasnull → Renders the custom canvas component from canvas.tsx (if provided)undefined or is omitted → No canvas is renderedThe build system generates:
build/routes/{route-name}/content.js - Bundled stage/inspector/canvas componentsbuild/routes/{route-name}/route.js - Bundled lifecycle hooks (if present)build/routes/index.php - Route registry databuild/routes.php - Route registration logicThe boot package in Gutenberg will automatically use these routes and make them available.
This is an individual package that's part of the Gutenberg project. The project is organized as a monorepo. It's made up of multiple self-contained software packages, each with a specific purpose.
The packages in this monorepo are published to npm and used by WordPress as well as other software projects.
To find out more about contributing to this package or Gutenberg as a whole, please read the project's main contributor guide.
GPL-2.0-or-later © The WordPress Contributors
FAQs
Build tool for WordPress plugins.
We found that @wordpress/build demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 23 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.