
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
astro-webfinger
Advanced tools
This [Astro integration](https://docs.astro.build/en/guides/integrations-guide/) allows any Mastodon instance to discover your Mastodon profile directly from your own domain.
astro-webfingerThis Astro integration allows any Mastodon instance to discover your Mastodon profile directly from your own domain.
Try it out In your favorite Mastodon instance, search for @toot@tonysull.co and you'll find my Mastodon profile.
Hosting a live Mastodon site on your own domain is no easy task. If you aren't ready to take that leap you can use your own domain as an alias to point to your Mastodon profile.
This uses the WebFinger protocol to attach information to an email, in this case to point an email address on your own domain to your Mastodon profile.
For example, I have a Mastodon profile at @tonysull@indieweb.social. The astro-webfinger integration is added to my Astro site at https://tonysull.co, allowing any Mastodon instance to discover my account by searching for toot@tonysull.co.
# npm
npm i @astrojs/rss
# yarn
yarn add @astrojs/rss
# pnpm
pnpm i @astrojs/rss
To configure this integration, pass a config object to the webfinger() function call in astro.config.mjs - both static (SSG) builds an server-rendered (SSR) builds.
The Webfinger protocol actually depends on using query parameters when searching for accounts. Because query parameters aren't actually supported in static builds, only one account can be provided to the account.
:caution: Query parameters won't actually be used at all when your account is requested, your account information will always be returned for any Webfinger request regardless of what was being searched for.
import webfinger from 'astro-webfinger'
export default defineConfig({
integrations: [
webfinger({
instance: 'myinstance.social',
username: 'myusername',
}),
],
})
With server-rendering the Webfinger query parameters can be used to actually match accounts. If the same integration options as above are passed during an SSR build, it will function the same as SSG and always return your account regardless of what was searched for.
To take full advantage of the benefits of SSR, the integration can be given an object mapping local usernames on your own domain to the related Webfinger accounts.
import webfinger from 'astro-webfinger'
export default defineConfig({
site: 'https://tonysull.co',
integrations: [
webfinger({
tony: {
instance: 'myinstance.social',
username: 'tony',
},
nottony: {
instance: 'secret.social',
username: 'someoneelse',
},
}),
],
})
In the example above, a search for:
tony@tonysull.co would return account information for @tony@myinstance.socialnottony@tonysull.co would return account information for @someoneelse@secret.socialCurrently the list of aliases and links in the Webfinger redirect are hard-coded for basic support. I'm definitely not a power user when it comes to the Fediverse but could see there being good reason to support custom aliases and links!
Have something else in mind? Start a discussion thread open an issue, or file a pull request if you're able to contribute code!
Inspired by Jekyll::MastodonWebfinger
Related articles
Maarten Balliauw's blog post Mastodon on your own domain without hosting a server
FAQs
This [Astro integration](https://docs.astro.build/en/guides/integrations-guide/) allows any Mastodon instance to discover your Mastodon profile directly from your own domain.
The npm package astro-webfinger receives a total of 12 weekly downloads. As such, astro-webfinger popularity was classified as not popular.
We found that astro-webfinger demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.