
Research
Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.
babel-plugin-split-import
Advanced tools
Babel plugin to transform imports to be normal in development and code split in production
When adding code splitting to our app we ran into the problem where recompile time while working in development was too slow. We found that the code splitting using dynamic imports was slowing it down. This plugin's goal is to transform imports to use code-splitting only in production so dev times are still fast.
yarn add babel-plugin-split-import --dev
Via .babelrc or babel-loader.
{
"plugins": [["split-import", options]]
}
options can be object.
{
"forcesplit": true // default false
}
By default, babel-plugin-split-import won't use code-splitting. Code splitting can be enabled through the FORCE_SPLIT command line variable or the forceSplit babel plugin option.
If you are using eslint, you will likely want to add simport as a global variable.
The first step is to set the function that returns a component given a loader via the simport.setSplitLoader function. This should be called before simport is used anywhere. Afterwards, call simport with the path to the imported component.
import Loadable from "react-loadable";
function makeLoadableComponent(loader) {
return Loadable({
loader
});
}
simport.setSplitLoader(makeLoadableComponent);
const MyComponent = simport("./path/to/MyComponent");
If the plugin is configured to use code splitting, then the code will compile to:
const MyComponent = makeLoadableComponent(() => import("./path/to/MyComponent"));
Otherwise, the code will compile to:
import MyComponent from "./path/to/MyComponent"
FAQs
Babel plugin to transform imports to be normal in development and code split in production
We found that babel-plugin-split-import demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.

Product
Explore exportable charts for vulnerabilities, dependencies, and usage with Reports, Socket’s new extensible reporting framework.

Product
Socket for Jira lets teams turn alerts into Jira tickets with manual creation, automated ticketing rules, and two-way sync.