
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
AssemBot is a simple asset assembler for use in developing JS web apps. It's designed for my own preferred way of development, so YMMV.
It's rather like stitch, but not exactly. It compiles an entire directory into a single, commonjs moduled, javascript file. It will also create a single .css file from all the styles in a single directory, recursively. It will transpile where appropriate (CoffeeScript, eco, less, stylus).
If you don't like the default conventions, you can configure it in your package.json file.
npm install -g assembot
You don't have to install it globally, but it comes with a pre-configured binfile to make it quick to use on a project. (It defaults to compiling ./source into public/app.js and public/theme.css)
At it's simplest:
cd my_project
assembot --build
If you want to configure it via package.json, just add an assembot section to your package and run assembot.
{
... Other node/npm stuff ...
"assembot": {
"output/my_file.js": {
"source": "./src"
"minify": 1
}
}
}
If you've not installed it globally, then you'll need to add it as a dependency to your project, then:
npm install
./node_modules/.bin/assembot --build
AssemBot will try to enable support for transpiling .coffee, .litcoffee, .eco, .dot, .ejs, .less, .styl files and more. It will also assemble .css, .js, and .html files. Any .html files become a module that exports the contents of the file as a string. Stylus support will attempt to enable Nib by default as well.
In your sources files you can embed data defined in your package.json file by using a special token syntax: {%- package.author -%}
If you have replaceTokens set to true, AssemBot will attempt to replace all tokens in your sources files. It is enabled by default.
AssemBot comes with a dev server, to use it:
assembot --serve
You can get a list of the supported command line options too:
assembot -h
The default AssemBot configuration from ./src/defaults.coffee:
exports.config=
source: './source'
ident: 'require'
autoStart: no
minify: 0 # 0=none, 1=minify, 2=mangle
sourceMap: no # still a work in progress
header: "/* Assembled by AssemBot {%- assembot.version -%} */"
replaceTokens: yes
coffee:
bare: yes
literate: no
exports.options=
port: 8080
wwwRoot: './public'
exports.assembot=
"public/app.js": exports.config
"public/theme.css": exports.config
FAQs
Simple asset assembly bot for compiling/combining client-side js and css files.
The npm package assembot receives a total of 1 weekly downloads. As such, assembot popularity was classified as not popular.
We found that assembot demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.