Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
assets-manager
Advanced tools
Assets manager provides a different approach to transfer the required files from your registry distributions to the target.
$ npm install --save assets-manager
import AssetsManager from 'assets-manager';
const assets = new AssetsManager('./manifest.json');
// copy all packages files to destination
assets.copyPackages();
// clean all packages files from destination
assets.cleanPackages();
// get packages info
assets.getPackagesInfo(['name', 'version', 'license']);
// look all packages
assets.forEachPackage(function(pkg){
});
// loop all js files in the packages
assets.forEachPackage('js', function(pkg, files){
});
// get package handler
const pkg = assets.getPackage('bootstrap');
// get package info
pkg.getInfo();
// get package path
pkg.getPath();
// get all files in package
pkg.getFiles();
// get specfic type files in package
pkg.getFilesByType();
// get main files of package
pkg.getMainFiles();
Assets manager can work with different package manager like npm, bower. Also It can use custom folders.
Just defined the registries in the manifest.json.
"registries": {
"vendor": "path-to-vendor",
"libs": "path-to-lib"
}
The relative path to the root of the project. Defaults to the manifest.json directory.
Whether to remove all package path parts from generated dest paths. Defaults to true.
Whether to remove all type path parts from generated dest paths. Defaults to false.
Whether to console log copy and clean files. Defaults to true.
Whether to override old exists destination files. Defaults to true.
Set default registry when package dont have a registry specify. Defaults to npm.
Set types that assets manage will classicfy files automatically.
Defaults:
{
js: '*.js',
coffee: '*.coffee',
es6: '*.es6.js',
css: '*.css',
stylus: '*.styl',
scss: '*.scss',
sass: '*.sass',
less: '*.less',
images: '*.{bmp,jpg,jpeg,png,gif,webp,tiff,wbmp,eps}',
fonts: '*.{eot,otf,svg,ttc,ttf,woff,woff2}'
}
The package key in the manifest.json take the following form:
"registry:package"
"registry:package@version"
"package"
"package@version"
The "package" and "package@version" shorter form will use the default registry.
The name of the dependency in the package can be any custom alias, that is then only locally scoped to that specific package.
Typically semver-compatible versions should be used of the form ^x.y.z. Tilde ranges, ~x.y.z are also supported. Ranges without a patch or minor are also supported - x, x.y, ~x.y, ^x.y.
More info about versions: https://docs.npmjs.com/getting-started/semantic-versioning https://github.com/npm/node-semver#ranges
You can write in the following ways define the package.
"PACKAGEKEY": true
It will use default types config and use default options.
"PACKAGEKEY": [
true,
{
"registry": "bower"
}
]
It will use default types config and custom options.
"PACKAGEKEY": [{
"js": "dist/js",
"css": "dist/css"
}]
It will use custom types config and default options.
"PACKAGEKEY": {
"js": "dist/js",
"css": "dist/css"
}
"PACKAGEKEY": [
{
"js": "dist/js",
"css": "dist/css"
},
{
"registry": "bower"
}
]
It will use custom types config and custom options.
{
js: 'path-to-js',
css: 'path-to-css'
}
{
js: '*.js',
css: 'css/*.css'
}
{
js: ['a.js', 'b.js'],
css: ['css/*.css', '!css/*.min.css']
}
js: {
'bootstrap.js': 'dist/js/bootstrap.js'
},
css: {
'main.css':'dist/css/bootstrap.css',
'theme.css':'dist/css/bootstrap-theme.css'
}
{
flattenPackages: true,
flattenTypes: false,
verbose: true,
override: true,
main: false,
registry: 'npm'
}
These options will override the global options.
Set to true will use bower/npm's main files.
Assets manager provides 2 separate hooks that can be used to trigger other automated tools during assets copy operate.
"hook:pre": "<your command here>",
"hook:post": "<your command here>",
{
"cwd": "./",
"registries": {
"vendor": "libs"
},
"defaultRegistry": "npm",
"verbose": true,
"override": true,
"flattenPackages": true,
"flattenTypes": false,
"dest": "assets",
"dests": {
"images": "images",
"fonts": "fonts",
"js": "js",
"coffee": "source/coffee",
"es6": "source/es6",
"css": "css",
"stylus": "source/stylus",
"less": "source/less",
"sass": "source/sass",
"scss": "source/scss"
},
"packages": {
"bower:jquery": true,
"npm:bootstrap": [{
"js": "dist/js",
"css": "dist/css",
"less": "less",
"fonts": "dist/fonts"
}],
"vendor:modernizr": {
"modernizr.js": "dist/modernizr.min.js",
}
}
}
MIT © amazingSurge
FAQs
Copy packages files based on manifest file
The npm package assets-manager receives a total of 5 weekly downloads. As such, assets-manager popularity was classified as not popular.
We found that assets-manager demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.