Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
bundlewatch
Advanced tools
BundleWatch checks file sizes, ensuring bundled browser assets don't jump in file size.
Sharp increases in BundleWatch can signal that something is wrong - adding a package that bloats the slug, a wrong import, or forgetting to minify.
Inspired by Siddharth Kshetrapal bundlesize
Install the BundleWatch package:
npm install bundlewatch --save-dev
yarn add bundlewatch --dev
Add some basic configuration to your package.json
{
"name": "my package name",
"version": "0.0.1",
"bundlewatch" : {
"files": [
{
"path": "myfolder/*.js",
"maxSize": "100kB"
}
]
}
}
Usage:
npm run bundlewatch
yarn run bundlewatch
This will give you command line output. If you want BundleWatch to report build status on your pull requests, see below.
BundleWatch can report its status on your GitHub Pull Requests.
BUNDLEWATCH_GITHUB_TOKEN
You will need to give BundleWatch access to your GitHub Statuses, which can be done by heading to: https://service.bundlewatch.io/setup-github
This will give you your BUNDLEWATCH_GITHUB_TOKEN
. You will need to set this as an environment variable in CI.
The most efficient way to get this running is to ensure that some environment variables are available for BundleWatch to find.
CI_REPO_OWNER
github.com/facebook/reactCI_REPO_NAME
github.com/facebook/reactCI_COMMIT_SHA
CI_BRANCH
If you're using, Travis, CircleCI, Wrecker or Drone these should all work out of the box.
Have a look at the source code to see which variables are automatically found: https://github.com/bundlewatch/bundlewatch/blob/master/src/app/config/getCIVars.js
After setting up the above you will have BuildStatus on your Pull Requests. Clicking the details link on the reported status will show you a results file breakdown.
Full documentation avialable on bundlewatch.io
Thanks goes to these wonderful people (emoji key):
Jake Bolam 💻 | Shouvik D'costa 💻 | Tyler Benning 🎨 | Lelia Rosenthal 📖 | Francois Campbell 💻 |
---|
Contributions of any kind are welcome! See the Contributing docs or Join us on Slack and start contributing.
© 2018 BundleWatch
FAQs
Keep watch of your bundle size
We found that bundlewatch demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.