Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
browser-rollup
Advanced tools
This repository implements the basic plug-in library for Rollup on the browser side, so that we can use Rollup plug-ins on the browser side.
Rollup officials specially packaged the browser version of Rollup for us! So we can use it directly through NPM or JSdelivr. But You Need A File System Polyfill!
// You can see rollup.browser.js is under the /dist/es/ folder!
import * as rollup from "https://cdn.jsdelivr.net/npm/rollup/dist/es/rollup.browser.js";
// We will know how to fill this Config next stage
const rollupConfig = {};
// This is a simple version of how to pack your code
const generated = await Rollup(rollupConfig).then((res) => {
if (output instanceof Array) {
return res.generate(output[0]);
} else if (output) {
return res.generate(output);
} else {
throw new Error("Rollup: 请填写 output 属性");
}
});
Actually, you can just make a Rollup Plugin to resolve the path of your code! I like to call it an adapter
.
// adapter.js
// use path in browser!
import { dirname, resolve } from "https://cdn.skypack.dev/path-browserify";
// We can set any way to read source code use readFile
export const adapter = (readFile) => ({
// It's just a pool code of resolving the path
// Your need to resolve it yourself!
async resolveId(thisFile, importer) {
if (!importer) return thisFile;
if (thisFile[0] !== ".") return false;
let resolved = resolve(dirname(importer), thisFile).replace(
/^\.\//,
""
);
return resolved;
},
// load is a Function to get your source code.
// It can be a Async Function
load(path) {
// 从这里进行导入字符串格式代码
return readFile(path);
},
});
// Use JSDelivr CDN we can load some plugin like this
import json from "https://cdn.jsdelivr.net/npm/browser-rollup/dist/plugin-json.js";
import alias from "https://cdn.jsdelivr.net/npm/browser-rollup/dist/plugin-alias.js";
import replace from "https://cdn.jsdelivr.net/npm/browser-rollup/dist/plugin-replace.js";
import commonjs from "https://cdn.jsdelivr.net/npm/browser-rollup/dist/plugin-commonjs.js";
// more plugin please look /dist folder
// put this plugin to the first stage!
const rollupConfig = {
input: "index.js",
output: {
file: "dist/index.js",
format: "es",
},
plugins: [
// it's just a lot of pool setting of my demo!
json(),
alias({
entries: [{ find: "utils", replacement: "./utils.js" }],
}),
replace({
"process.env.NODE_ENV": JSON.stringify("production"),
__buildDate__: () => JSON.stringify(new Date()),
__buildVersion: 15,
}),
commonjs(),
// readFile is your way to load code
adapter(readFile),
],
};
Babel is awesome! Babel can compile typescript and many other, and they carefully make browser version in their project!
So we use plugin-babel must load Babel first! like this!
// It will inject a Global Babel in window,So it must be the first to load
import "https://cdn.jsdelivr.net/npm/@babel/standalone@7.16.9";
import babel from "https://cdn.jsdelivr.net/npm/browser-rollup/dist/plugin-babel.js";
// babel is the same Function to @rollup/plugin-babel
// commonjs will compile require and some special syntax to es5
commonjs({
extensions: [".cjs"],
});
// Use babel like this!
commonjs({
// My project mixed some commonjs ,so I need it
extensions: [".cjs", ""],
}),
babel({
// Yes , Babel provide most common used preset in it's bundle
presets: [Babel.availablePresets["typescript"]],
babelHelpers: "runtime",
// specially add next line, something Bug I can not understand, but use this way to avoid it.
extensions: [".js", ".jsx", ".es6", ".es", ".mjs",".ts"],
}),
FAQs
Use Rollup in Browser to compile your code!
The npm package browser-rollup receives a total of 0 weekly downloads. As such, browser-rollup popularity was classified as not popular.
We found that browser-rollup demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.