
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
AssemBot is a simple asset assembler for use in developing JS web apps. It's designed for my own preferred way of development, so YMMV.
It's rather like stitch, but not exactly. It can compile an entire directory into a single, commonjs moduled, javascript file. It can also create a single .css file from all the styles in a single directory, recursively. It will also transpile where appropriate (CoffeeScript, eco, less, stylus, etc). You can enable pruning to excise modules you don't require in your code.
If you don't like the default conventions, you can configure it in your package.json file. You can also extend AssemBot with plugins to add processor, or packages types. See the docs for more.
npm install -g assembot
You don't have to install it globally, but it comes with a pre-configured binfile to make it quick to use on projects. (It defaults to compiling ./source into public/app.js and public/app.css)
At it's simplest:
cd my_project
assembot build
If you want to configure it via package.json, just add an assembot section to your package and run assembot.
{
... Other node/npm stuff ...
"assembot": {
"targets": {
"output/my_file.js": {
"source": "./source"
"minify": 1
}
}
}
}
If you've not installed it globally, then you'll need to add it as a dependency to your project, then:
npm install assembot --save
./node_modules/.bin/assembot --build
AssemBot can give you a head start by creating a assembot configuration block for you:
assembot init
AssemBot initially enables support for transpiling .coffee, .litcoffee, .eco, .dot, .ejs, .less, and .styl files. When using stylus, it will attempt to enable Nib by default as well.
There's a start on some others as well. Plus, you can always add your own.
In your sources files you can reference data defined in your package.json file by using a special token syntax: {%- package.author -%}
AssemBot will attempt to replace all tokens in your sources files. To disable this behavior, set replaceTokens to false.
It also supports compiling CSS into the JS package. Use .ecss (or .estyl or .eless) file extension. Generates a module you can use like this:
require('my/view/styles').activate()
# EmbeddCSS API:
# .activate() - Appends a generated <style> tag to HEAD, BODY, or document
# .deactivate() - Removes the generated <style> tag
# .isActive() - Boolean
AssemBot comes with a dev server, to use it:
assembot serve
Following are the default AssemBot configuration values, when creating your own configuration, you don't need to specify all on these -- only those you wish to override:
{
"assembot": {
"options": {
"header": "/* Assembled by AssemBot {%- assembot.version -%} */",
"addHeader": true,
"minify": 0,
"ident": "require",
"autoload": false,
"main": null,
"prune": false,
"replaceTokens": true,
"plugins": [],
"coffee": {
"bare": true
},
"http": {
"port": 8080,
"paths": {
"/": "./public",
"/components": "./components"
}
}
},
"targets": {
"public/app.js": {
"source": "./source"
},
"public/app.css": {
"source": "./source"
}
}
}
}
FAQs
Simple asset assembly bot for compiling/combining client-side js and css files.
The npm package assembot receives a total of 0 weekly downloads. As such, assembot popularity was classified as not popular.
We found that assembot demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.