Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
@yoast/grunt-plugin-tasks
Advanced tools
The plugin that contains all custom Yoast tasks
This plugin requires Grunt ^1.0.4
If you haven't used Grunt before, be sure to check out the Getting Started guide, as it explains how to create a Gruntfile as well as install and use Grunt plugins. Once you're familiar with that process, you may install this plugin with this command:
npm install grunt-yoast-tasks --save-dev
Once the plugin has been installed, it may be enabled inside your Gruntfile with this bit of JavaScript:
// Load Grunt configurations and tasks
loadGruntConfig( grunt, {
configPath: path.join( process.cwd(), "node_modules/@yoast/grunt-plugin-tasks/config/" ),
overridePath: path.join( process.cwd(), project.paths.config ),
data: project,
jitGrunt: {
staticMappings: {
addtextdomain: "grunt-wp-i18n",
makepot: "grunt-wp-i18n",
glotpress_download: "grunt-glotpress",
"update-version": "@yoast/grunt-plugin-tasks",
"set-version": "@yoast/grunt-plugin-tasks",
},
},
} );
You can override individual task configs by adding them to your plugin's local grunt config directory.
This adds the following tasks to your plugin's repo:
In your project's Gruntfile, add a section named yoast_tasks
to the data object passed into grunt.initConfig()
.
grunt.initConfig({
yoast_tasks: {
options: {
// Task-specific options go here.
},
your_target: {
// Target-specific file lists and/or options go here.
}
}
});
Type: String
Default value: ''
The JSON file base object for the target to be in.
Type: String
Default value: ''
The child of the options.base object to replace the version string in.
Type: String
Default value: ''
The source JSON file to set the version in.
packageJSON: {
options: {
base: "someOrganisation",
target: "pluginVersion",
},
src: "tmp/testPackage.json",
}
In your project's Gruntfile, add a section named yoast_tasks
to the data object passed into grunt.initConfig()
.
grunt.initConfig({
yoast_tasks: {
options: {
// Task-specific options go here.
},
your_target: {
// Target-specific file lists and/or options go here.
},
},
});
Type: String
Default value: ''
The string value that will be the new version string.
Type: String
Default value: ''
A regex string that is used to find the line to be updated in the file.
Type: String
Default value: ''
A prefix to the version string, for example a regex capture group.
Type: String
Default value: ''
A postfix to the version string, for example a regex capture group.
readme: {
options: {
version: "1.1",
regEx: /(Stable tag: )(\d+(\.\d+){0,3})([^\n^\.\d]?.*?)(\n)/,
preVersionMatch: "$1",
postVersionMatch: "$5"
},
src: "tmp/README.md"
}
options.regEx
.grunt-glotpress
variant.grunt-sass
.node-sass
.grunt-replace
.cssnano
.grunt
, grunt-shell
, grunt-replace
, load-grunt-config
.grunt-contrib-clean
, grunt-contrib-compress
, grunt-contrib-copy
, grunt-contrib-cssmin
, grunt-contrib-imagemin
, grunt-contrib-watch
.grunt-phpcs
, grunt-eslint
.grunt-postcss
, autoprefixer
, grunt-sass
, grunt-rtlcss
.grunt-glotpress
, grunt-wp-i18n
, grunt-checktextdomain
.grunt-wp-deploy
, time-grunt
.FAQs
Custom Yoast grunt tasks
The npm package @yoast/grunt-plugin-tasks receives a total of 128 weekly downloads. As such, @yoast/grunt-plugin-tasks popularity was classified as not popular.
We found that @yoast/grunt-plugin-tasks demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.