
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@zippybee/plugin-cdn-import
Advanced tools
允许指定 modules 在生产环境中使用 CDN 引入。
这可以减少构建时间,并且提高生产环境中页面加载速度。
下载 npm 插件
npm install vite-plugin-cdn-import --save-dev
or yarn
yarn add vite-plugin-cdn-import -D
// vite.config.js
import reactRefresh from '@vitejs/plugin-react-refresh';
import importToCDN from 'vite-plugin-cdn-import';
export default {
plugins: [
importToCDN({
modules: [
{
name: 'react',
var: 'React',
path: `umd/react.production.min.js`,
},
{
name: 'react-dom',
var: 'ReactDOM',
path: `umd/react-dom.production.min.js`,
},
],
}),
],
};
// vite.config.js
import reactRefresh from '@vitejs/plugin-react-refresh';
import importToCDN, { autoComplete } from 'vite-plugin-cdn-import';
export default {
plugins: [
importToCDN({
modules: [autoComplete('react'), autoComplete('react-dom')],
}),
reactRefresh(),
],
};
"react" | "react-dom" | "react-router-dom" |
"antd" | "ahooks" | "@ant-design/charts" |
"vue" | "vue2" | "@vueuse/shared" |
"@vueuse/core" | "moment" |
"eventemitter3" | "file-saver" |
"browser-md5-file" | "xlsx | "crypto-js" |
"axios" | "lodash" | "localforage"
import vue from '@vitejs/plugin-vue';
import { importToCDN, autoComplete } from '@zippybee/plugin-cdn-import';
export default {
plugins: [
vue(),
importToCDN({
modules: [
autoComplete('vue'), // vue2 使用 autoComplete('vue2')
autoComplete('@vueuse/shared'),
autoComplete('@vueuse/core'),
],
}),
],
};
| Name | Description | Type | Default |
|---|---|---|---|
| prodUrl | 覆盖全局 prodUrl 属性,允许为特定的模块指定 CDN 的位置 | string | https://cdn.jsdelivr.net/npm/{name}@{version}/{path} |
| modules | 模块配置 | Array<Module> / Array<(prodUrl:string) => Module> | - |
| Name | Description | Type |
|---|---|---|
| name | 需要 CDN 加速的包名称 | string |
| var | 全局分配给模块的变量,Rollup 需要这个变量名称 | string |
| path | 指定 CDN 上的加载路径 | string / string[] |
| css | 可以指定从 CDN 地址上加载多个样式表 | string / string[] |
| Name | pordUrl |
|---|---|
| unpkg | //unpkg.com/{name}@{version}/{path} |
| cdnjs | //cdnjs.cloudflare.com/ajax/libs/{name}/{version}/{path} |
FAQs
Import packages from CDN for the vite plugin
We found that @zippybee/plugin-cdn-import demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.