
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
AssemBot is a simple asset assembler for use in developing JS web apps. It's designed for my own preferred way of development, so YMMV.
It's rather like stitch, but not exactly. It compiles an entire directory into a single, commonjs moduled, javascript file. It will also create a single .css file from all the styles in a single directory, recursively. It will transpile where appropriate (CoffeeScript, eco, less, stylus).
If you don't like the default conventions, you can configure it in your package.json file.
npm install -g assembot
You don't have to install it globally, but it comes with a pre-configured binfile to make it quick to use on a project. (It defaults to compiling ./source into public/app.js and public/theme.css)
At it's simplest:
cd my_project
assembot --build
If you want to configure it via package.json, just add an assembot section to your package and run assembot.
{
... Other node/npm stuff ...
"assembot": {
"output/my_file.js": {
"source": "./src"
"minify": 1
}
}
}
If you've not installed it globally, then you'll need to add it as a dependency to your project, then:
npm install assembot --save
./node_modules/.bin/assembot --build
AssemBot initially enables support for transpiling .coffee, .litcoffee, .eco, .dot, .ejs, .less, and .styl files. When using stylus, it will attempt to enable Nib by default as well.
In your sources files you can embed data defined in your package.json file by using a special token syntax: {%- package.author -%}
AssemBot will attempt to replace all tokens in your sources files. To disable this behavior, set replaceTokens to false.
Supports compiling CSS into the JS package. Use .ecss (or .estyl or .eless) file extension. Generates a module you can use like this:
require('my/view/styles').activate()
# EmbeddCSS API:
# .activate() - Appends a generated <style> tag to HEAD, BODY, or document
# .deactivate() - Removes the generated <style> tag
# .isActive() - Boolean
AssemBot comes with a dev server, to use it:
assembot --serve
You can get a list of the supported command line options too:
assembot -h
The default AssemBot configuration from ./src/defaults.coffee:
exports.config=
source: './source'
ident: 'require'
autoStart: no
minify: 0 # 0=none, 1=minify, 2=mangle
sourceMap: no # still a work in progress
header: "/* Assembled by AssemBot {%- assembot.version -%} */"
replaceTokens: yes
coffee:
bare: yes
literate: no
exports.options=
port: 8080
wwwRoot: './public'
exports.assembot=
"public/app.js": exports.config
"public/theme.css": exports.config
FAQs
Simple asset assembly bot for compiling/combining client-side js and css files.
The npm package assembot receives a total of 0 weekly downloads. As such, assembot popularity was classified as not popular.
We found that assembot demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.