Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Make like task runner, with npm script goodness
Given the following Makefile
foo2:
echo foo2
foo: prefoo
echo foo
prefoo:
echo prefoo
foobar: prefoobar
echo foobar
prefoobar:
echo blahblah
all: foo foo2 foobar
Run bake
$ bake
bake info Invoking foo target
bake info Invoking prefoo target
prefoo
foo
bake info Invoking foo2 target
foo2
bake info Invoking foobar target
bake info Invoking prefoobar target
blahblah
foobar
bake info ✔ Build sucess in 41ms
$ bake <target> [options]
Options:
-h, --help Show this help
-v, --version Show package version
-d, --debug Enable extended output
Targets:
foo2 Run target foo2
foo Run target foo
prefoo Run target prefoo
foobar Run target foobar
prefoobar Run target prefoobar
Bake is a little experiment to implement a simple task runner similar to
Make in JavaScript, while bringing in the conveniency of npm scripts with
$PATH
and environment variables.
It takes a similar approach to Make with a very close syntax.
Recipes (or rules, the commands defined for a target / task), are executed with
bash -c
(similar to npm scripts).
For now, basic variable and target declarations are supported, along with basic prerequities support (eg. task depending on other tasks).
./node_modules/.bin
is made available, like npm does for npm scripts.bash -c
instead of executing each rule, line by line like Make does.todo
bake_*
similar to npm_*
available in npm scirptshelp:
echo """
Some help message here:
Run with bake help
"""
all: help
This, with Make, would throw an error
$ make help
echo """
/bin/sh: 1: Syntax error: Unterminated quoted string
Makefile:8: recipe for target 'help' failed
make: *** [help] Error 2
While, bake is ok with it
$ bake help
bake info Invoking help target
Some help message here
Run with bake help
bake info ✔ Build sucess in 43ms
somevar = anything after "=" is considered the value till the end of the line
OUT_FLAGS = output.js
build-js:
cat a.min.js b.min.js > $OUT_FLAGS
echo JS file built
The syntax and behavior is a bit different. Instead of using $(var)
syntax,
$var
is used instead (that might changed to allow bash variables within
recipes, which uses this syntax).
Use prerequities to specify tasks that depends on other tasks.
Makefile
prebuild:
echo done
build: prebuild
deploy: build
Output
$ bake deploy
bake info Invoking deploy target
bake info Invoking build target
bake info Invoking prebuild target
done
bake info ✔ Build sucess in 50ms
Recipes run in an environment very similar to the environment npm scripts are
run in, namely the PATH
environment variable.
If you depend on modules that define executable scripts, like test suites,
then those executables will be added to the PATH
for executing the scripts.
So, if your package.json has this:
{
"name" : "foo" ,
"dependencies" : { "bar" : "0.1.x" }
}
then you could run bake to execute a target that uses the bar
script, which
is exported into the node_modules/.bin
directory on npm install
.
0.0.3 (2016-05-24)
<a name="0.0.2"></a>
FAQs
Make like Task runner
The npm package bake-cli receives a total of 101 weekly downloads. As such, bake-cli popularity was classified as not popular.
We found that bake-cli demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.