Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
astra-plugin
Advanced tools
astra-plugin
aims to integrate Vite as seamlessly as possible with Shopify themes for a best-in-class developer experience.
script
and link
tags for entrypointsnpm i astra-plugin -D
# yarn
yarn add astra-plugin -D
# pnpm
pnpm add astra-plugin -D
Add the astra-plugin
plugin to vite.config.js
/ vite.config.ts
:
import astra from "astra-plugin";
export default {
plugins: [
/* Plugin options are not required, defaults shown */
astra({
// Root path to your Shopify theme directory (location of snippets, sections, templates, etc.)
themeRoot: "./",
// Front-end source code directory
sourceCodeDir: "src",
// Front-end entry points directory
entrypointsDir: "src/entry",
// Additional files to use as entry points (accepts an array of file paths or glob patterns)
additionalEntrypoints: [],
}),
],
};
You can customize this file as needed. Check Vite's plugins and config reference for more info.
The Shopify Vite plugin treats each script and stylesheet in the entrypoints directory (src/entrypoints
by default) as an input for the Vite build. You can organize the rest of your frontend code however you'd like. For example:
src
├── index.ts # entry point for JS files
├── theme.css # entry point for CSS and style files
│
│ # Additional frontend source files to be imported from entrypoints
│── components
│ └── App.vue
│── stylesheets
│ └── my_styles.css
└── images
└── logo.svg
astra
loads entrypoints by specifying a value for the entrypointsDir
plugin option.In your <head>
element add this
Then render the astra
snippet (in your <head>
element too) to insert tags for loading assets from a given entrypoint file:
{% render 'astra' with 'theme.ts' %}
astra
will generate new versions of astra.liquid
during development and on each production build.astra
snippet will render HTML tags to load the provided entrypoint.type="module"
and crossorigin
attributes like Vite does by default.asset_url
filter is used to load resources from the Shopify CDN.astra
snippet will automatically render separate tags for loading stylesheets and preloading imported JS chunks.astra
snippet will render a <script>
that includes the Vite client script to enable HMR.{% render 'astra' with 'theme.ts' %}
# HTML output (development)
<script src="http://localhost:5173/theme.ts" type="module"></script>
# HTML output (production)
<link rel="stylesheet" href="{{ 'theme.4d95c99b.css' | asset_url }}">
<script src="{{ 'theme.3b623fca.js' | asset_url }}" type="module" crossorigin="anonymous"></script>
<link href="{{ 'lodash.13b0d649.js' | asset_url }}" rel="modulepreload" as="script" crossorigin="anonymous">
asset_url
filter and a relative base path.Loading additionalEntrypoints
:
# Relative to sourceCodeDir
{% render 'astra' with '@/foo.ts' %}
{% render 'astra' with '~/foo.ts' %}
# Relative to themeRoot
{% render 'astra' with '/resources/bar.ts' %} # leading slash is required
Preloading stylesheets:
{% render 'astra' with 'theme.css', preload: true %}
Note: The
preload
parameter will enable thepreload
parameter of thestylesheet_tag
, use it sparingly e.g. consider preloading only render-blocking stylesheets. Learn more
For convenience, ~/
and @/
are aliased to your src
folder, which simplifies imports:
import App from "@/components/App.vue";
import "@/styles/my_styles.css";
Please create an issue if you found any bugs, to help us improve this project!
We would like to specifically thank the following projects, for inspiring us and helping guide the implementation for this plugin by example:
FAQs
Vite plugin providing integration for Shopify themes
The npm package astra-plugin receives a total of 0 weekly downloads. As such, astra-plugin popularity was classified as not popular.
We found that astra-plugin demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.