
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Bundles on the fly
This is a base project with a custom bundler that uses only babel and postcss. It doesn't have a separate build process, but instead has an asset server which will serve all assets in the project bundling all the javascript and css upon request and caching the result. The actual app works as an overview for the reasoning and architecture of the tool. Also it uses preact instead of react and redux-zero instead of redux since they are a tenth of the size.
It uses an asset server to serve files as bundles. I.e. which ever file you would request in the project, it will try to bundle and serve it. It uses babel and postcss plugins do bundle the files, resolving dependencies and ensuring cjs compatibility etc. There are three steps in bundling a file:
So as you see the problem is a type of an expand - map - reduce
problem and solved as such. This is what gives the tool major performance benefits over the current tools available, meaning that it doesn't matter if it bundles the dependencies as well as the native code.
clone
npm i
npm start
browse to http://localhost:4000/index.html
To see a bundled js file, run http://localhost:4000/src/index.js
And to see the styles bundle for that js file, run http://localhost:4000/src/index.jscss
And corresponding sourcemaps at http://localhost:4000/src/index.js.map & http://localhost:4000/src/index.jscss.map
npm run start:production
npm run build:static
The bundlerb.config.js file at the root is used as the configuration file, see the comments in it to understand how it's used. It's not yet clear what parts should be pushed into code and what parts should be pulled into configuration so this project will stay as a template project, until that becomes clearer.
FAQs
bundles on the fly
The npm package bundlerb receives a total of 4 weekly downloads. As such, bundlerb popularity was classified as not popular.
We found that bundlerb demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.