Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Update browser property in package.json for use bower components in browserify by their names.
The module goal is to update browser
property in package.json
and use bower components in browserify by their names.
Currently, browserify can resolves paths only packages installed via npm
, to use components installed via bower, you should manually update browser
property in package.json
, or use relative paths in require()
. Bobr updates browser
property in package.json
, allows you use bower modules by name in require()
.
// package.json
browser: [ // updated by bobr
"jquery": "./bower_components/jquery/dist/jquery.js",
...
]
// in your module
var $ = require('jquery');
npm i -D bobr
Bobr should be used in task runners, such as Gulp or Grunt. Below, the example of gulp task which run Bobr:
var gulp = require('gulp');
var bobr = require('bobr');
var browserify = require('browserify');
// Update browser property
gulp.task('bobr', function() {
bobr.run({
overrides: [
{
name: 'jquery'
newName: 'jqueryModule'
}
],
browserExternalFile: './config/browser-external.json',
});
});
// Browserify modules, will be run, after bobr will be finished
gulp.task('browserify', ['bobr'], function(cb) {
// create bundles
}
overrides
- an array of objects to override module names. By default, module name is a js file name without extension, use this option to override this.browserExternalFile
- a path to a json file with your own modules, which you want to browserify. Bobr concatenate these modules with bower modules.This code available under the MIT License. See License.md for details.
Alexander Mac
FAQs
Update browser property in package.json for use bower components in browserify by their names.
The npm package bobr receives a total of 0 weekly downloads. As such, bobr popularity was classified as not popular.
We found that bobr demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.