
Research
/Security News
CanisterWorm: npm Publisher Compromise Deploys Backdoor Across 29+ Packages
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.
bundle-require
Advanced tools
💛 You can help the author become a full-time open-source maintainer by sponsoring him on GitHub.
Projects like Vite need to load config files provided by the user, but you can't do it with just require() because it's not necessarily a CommonJS module, it could also be a .mjs or even be written in TypeScript, and that's where the bundle-require package comes in, it loads the config file regardless what module format it is.
node_modules are excluded because it's problematic to try to bundle it
__filename, __dirname and import.meta.url are replaced with source file's value instead of the one from the temporary output fileesm format if possible (for .ts, .js input files)import() if possiblenpm i bundle-require esbuild
esbuild is a peer dependency.
import { bundleRequire } from 'bundle-require'
const { mod } = await bundleRequire({
filepath: './project/vite.config.ts',
})
https://www.jsdocs.io/package/bundle-require
MIT © EGOIST
The require-from-string package allows you to require a module from a string of code. Unlike bundle-require, it does not support bundlers directly but can be used to load code dynamically from a string.
The esm package enables ES module support in Node.js. While it does not directly handle bundling, it allows you to use ES modules seamlessly, which can be useful in conjunction with bundlers.
The import-fresh package allows you to import a module while bypassing the require cache. This can be useful for dynamically loading modules, but it does not handle bundling like bundle-require.
FAQs
bundle and require a file
The npm package bundle-require receives a total of 1,736,368 weekly downloads. As such, bundle-require popularity was classified as popular.
We found that bundle-require demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.