
Research
/Security News
16 Malicious Firefox Extensions Steal Cryptocurrency Wallet Credentials
Socket found 16 malicious Firefox extensions designed to steal crypto wallet recovery phrases and private keys using cloned Rabby and OKX interfaces.
@workflow/builders
Advanced tools
Shared builder infrastructure for Workflow SDK. This package provides the base builder class and utilities used by framework-specific integrations.
This package contains the core build logic for transforming workflow source files into deployable bundles. It is used by:
@workflow/cli - For standalone/basic builds@workflow/next - For Next.js integration@workflow/nitro - For Nitro/Nuxt integrationThis package is typically not used directly. Instead, use one of the framework-specific packages that extend BaseBuilder:
import { BaseBuilder } from '@workflow/builders';
class MyBuilder extends BaseBuilder {
async build(): Promise<void> {
// Implement builder-specific logic
}
}
Builder configurations can provide an optional onAfterTransform observer for
tooling that derives metadata from the exact SWC output used by a build:
import type { WorkflowAfterTransformHook } from '@workflow/builders';
// Pass as `onAfterTransform` in the builder configuration.
const onAfterTransform: WorkflowAfterTransformHook = async ({
mode,
filename,
absolutePath,
source,
code,
workflowManifest,
}) => {
// Observe the accepted transform result.
};
The observer is awaited after the transform's manifest entries have been accepted. It cannot replace the generated code, and throwing aborts the build. A source file may be observed multiple times across transform modes, bundles, and watch rebuilds, so consumers should deduplicate results when necessary.
The builder system uses:
"use workflow", "use step")MIT
FAQs
Shared builder infrastructure for Workflow SDK
The npm package @workflow/builders receives a total of 1,404,990 weekly downloads. As such, @workflow/builders popularity was classified as popular.
We found that @workflow/builders demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Research
/Security News
Socket found 16 malicious Firefox extensions designed to steal crypto wallet recovery phrases and private keys using cloned Rabby and OKX interfaces.

Product
Socket now scans VS Code extensions, giving teams early detection of risky behaviors, hidden capabilities, and supply chain threats in developer tools.

Research
/Security News
Socket uncovered two malicious VS Code themes in a GlassWorm-linked cluster with thousands of installs across VS Code Marketplace and Open VSX.