Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Assetflow is an asset deployment tool for node. It enables you to create powerfull asset flows easily and fast.
Assetflow is a Grunt task and works with S3 out of the box. It will take care of versioning and apply solid cache-busting techniques transparently.
If you are not familiar with Grunt check out the Grunt's Getting Started guide.
A typical deployment flow using assetflow:
manifest.json
file.HEAD
operations with S3 and compare hashes using S3's ETAG
.ETAG
.Optionally there are two more tasks you can perform:
__ASSET(img/logo.jpg)
.clientManifest.js
file, a client optimized subset of the manifest.npm install assetflow --save-dev
Open your Gruntfile and add the following config:
assets: {
options: {
manifest: 'temp/manifest.json',
},
all: {
src: ['assets/**'],
dest: 'temp/assets'
},
},
assetsS3: {
options: {
checkS3Head: true,
manifest: 'temp/manifest.json',
key: config.aws_key,
secret: config.aws_secret,
bucket: config.aws_static_bucket,
access: 'public-read',
},
target: {
upload: {
src: 'temp/assets/**',
dest: 'assets/'
}
}
}
assets
The assets
task performs these operations:
manifest.json
file.
When this task finishes all your assets have been copied to a new temporary folder that you defined. This folder will contain your assets renamed with their own hash, like so:
app.js
--> app-h522md41d.js
The manifest.json
file generated by this task keeps a reference to all your assets so their names can be properly resolved in all environments.
manifest
Type: string
Default: manifest.json
Define the location of the manifest file.
cdnurl
Type: string
Default: none
Add the url of your CDN to prepend it to all assets.
rel
Type: string
Default: none
The rel
option will perform directory substraction on the source to calculate the relative path to the asset. Consider this case:
Your folder of static assets is under assets/
, so the path to your logo would be assets/img/logo.png
which would be accessed by the browser as /img/logo.png
.
Declaring the assets
folder as a rel
path will make sure that all assets have the proper url.
Example
assets: {
options: {
rel: 'assets/'
},
all: {
src: 'assets/**',
dest: 'temp/assets'
}
}
truncateHash
Type: number
Default: none
The md5 hash is 32 bytes long, you don't need all of it, use this option to truncate the hash down to n chars.
prepend
Type: string
Default: none
This option will prepend a value to the asset's key. It is mostly used to prepend a slash and make the asset key absolute, for example:
By default, the assets
task will create records in the manifest.json
file as relative web paths: img/logo.png
. If you need the key to be an absolute path then you have to use prepend
.
options: {
prepend: '/'
}
maxOperations
Type: number
Default: 100
The maximum number of concurent operations, in this case the operations are file copying.
progress
Type: boolean
Default: false
A fancy progress bar.
debug
Type: boolean
Default: false
Print extra debugging information.
assetsReplace
The assetsReplace
task will search and replace the contents of your assets. It is usefull for cases where you don't have the ability of a 'helper' to resolve your assets.
LESS files are a typical example, use a custom keyword to include your assets and run the assetsReplace
task to populate the asset urls in your .less
files. For example if the custom keyword is __ASSET()
:
@bg-dot-light: url(__ASSET(img/pdf-icon-cv.png)) repeat 0 0 #2a2a2a;
After the assetsReplace
task is executed the same line will look like this:
@bg-dot-light: url(http://d3s3z9buwru1xx.cloudfront.net/assets/img/pdf-icon-cv-fk44j2s.png) repeat 0 0 #2a2a2a;
The
assetsReplace
task is based ongrunt-string-replace
by @erickrdch
FAQs
Asset deployment for node
The npm package assetflow receives a total of 4 weekly downloads. As such, assetflow popularity was classified as not popular.
We found that assetflow demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.