
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
Brew is a NodeJS class that keeps source files compiled and bundled, available in memory. For examples:
style, less, and/or css files compiled into a single chunk of css.coffee and js into a single js package.toffee, eco, or whatever into jsWhat brew does:
compile function you provide on all matching files, which can do whatever you wantjoin function you providecompress function you provide.Basically: it decouples all this annoying file monitoring from your important compile, join, and compress steps.
npm install -g brew
The following example in coffeescript just monitors 2 directories (and all their subdirs) full of .js files
and combines them together into a single .js file. The ordering of the includes matters, and in this example a certain file is singled out
to be first, even though it's also requested in one of the later directories.
brew = require('brew').brew
my_tasty_brew = new brew {
includes: [
"./js/bar/1.js"
"./js/foo/"
"./js/bar/"
]
excludes: [
"./js/bar/bad_code.js"
"./js/foo/bad_dir/"
]
match: /^.*\.js$/ # don't compile anything unless it ends in .js
compile: (path, txt, cb) -> cb null, txt # the trivial compile
join: (strs, cb) -> cb null, (strs.join "\n") # the trivial join
compress: (str, cb) -> cb null, str.replace /[ \n\t\r]+/g, ' ' # strip extra whitespace
onChange: (vhash, txt, compressed_txt) -> console.log "the brew has changed; version hash = #{vhash}"
onReady: (vhash, txt, compressed_txt) -> console.log "the brew is ready; version hash = #{vhash}"
}
Once a brew is ready (you've gotten an onReady call), you can access its compiled text and version numbers at any time:
vh = my_tasty_brew.getVersionHash()
txt = my_tasty_brew.getCompiledText()
ctxt = my_tasty_brew.getCompressedText()
includes: this should be an array containing directories and/or files. Order matters. If a file qualifies twice, its priority will be determined by its first mention or ancestor directory mention.exclude: (optional) files and directories to ignore.match: (optional) a file will only be compiled/included if its name matches this regexp.compile: (optional) your compile function is called on every matching file. You should call back with err, txt; the default compile function leaves text unmolested.join: (optional) your join function gets an array of all the compiled texts and is responsible for turning them into one new text. Note that you may wish to do final compilation here, too. For example, with a less compilation, you might prefer to do nothing in compile but just join them all together and compile the results here.compress: (optional) your compress function takes the final joined string, and calls back with a new string, compressed. If you provide a compress function, this allows you to call getCompressedText()onReady: brew calls this once it has made its first pass and compiled & joined everythingonChange: (optional) this function is called if a version hash changeslogger: (optional) if you provide a logger function, brew will pass all kinds of verbose lines of text to it. Your logger function shuould take one parameter, a string.It's just an 8 character hex string, representing the results of all your files compiled and joined together. If you change a file, this hash will change. You can use it for cache-busting, versioning, whatever.
Yes!
getCompiledText() results to reply to users' requests for JS/CSS/whatever, cutting the filesystem out.npm install -g iced-coffee-scriptnpm install -g coffee-scriptcake build.js files directly, as they're generated by cake.FAQs
A NodeJS module for compiling and packaging together files with async updates.
The npm package brew receives a total of 1,553 weekly downloads. As such, brew popularity was classified as popular.
We found that brew demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.