
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
ExpressJS based API centric static site CMS.
npm init (If you haven't already)
npm install boxescms
npx boxes init
npm start dev
Env variables. Copy from .env.example.
Optional app.js to extend the Express app instantiated from BoxesCMS. Must export a function or preinit/postinit functions that receives the app as first argument.
Data layer as Pug locals for static HTML generation. For js type, it must export an object. See Template Data section for more details.
Server and node related files.
Only API routes. All routes are prepended with /api, appended with folder/file relative path. Routes should be declared using require('express').Router().
Additional custom routes.
Web related files (html, pug, sass, scss, js, images, statics).
Pug files that will be compiled /public/**/*.html.
SASS/SCSS files that will be compiled to /public/css/**/*.css.
JS files that will be compiled to /public/js/**/*.js.
Images that will be copied to /public/images.
Statics that will be copied to /public/static.
Pug template files for data use. See Template Data section for more details.
Web files will be compiled here, and served as root static by Node server.
Contents should be ignored. Storage folder for various runtime data usage.
External configuration files.
Optional Webpack configuration. This configuration will be merged into the default configuration.
There is 2 special env var that you can use in your JS files:
process.env.VERSION is taken from your project's package.json.version.
process.env.BUILD_HASH is a randomly generated per build 64 length hex char.
The data files in /data/**/*.{js,json,yml} is used in 2 ways:
/web/pug/[**/*].pug file, if there is a matching /data/[**/*].{js,json,yml} file, it will use the data file as the locals for Pug compilation. The pug files will be compiled to /public/[**/*].html.head
title=pagetitle
pagetitle: Hello World
<head><title>Hello World</title></head>
/data/**/*.{js,json,yml} has a key .template, the .template value will use /web/template as root to search for the pug file to compile, e.g.: /web/template/['.template'].pug}. The output file for /data/[**/*].{js,json,yml} is /public/[**/*].html{
".template": "base.pug",
"pagetitle": "Hello World"
}
head
title=pagetitle
<head><title>Hello World</title></head>
Apart from a general template data, you can create dotfiles to create multiple pages under a single template. Currently only supports .js file, in /data/**/.*.js
The data file must contain .template key to define what template to use. Subsequent keys will be the page to create, and the value is an object of the locals to use for that page.
The file should export a Promise instance, in which allows you to perform async operations to populate the final object to resolve.
const data = {
'.template': 'index.pug',
'/dashboard': {
title: 'Dashboard'
}
}
module.exports = new Promise((resolve, reject) => {
// async operations if needed
resolve(data)
})
<head><title>Dashboard</title></head>
The node inspector can be enabled by passing --inspect [port=9229] to boxes start command. You can either use chrome://inspect on Chrome browser to use the default .vscode/launch.json from init to attach debugger.
FAQs
ExpressJS based API centric CMS.
We found that boxescms demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.