
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
cache-loader
Advanced tools
The cache-loader allow to Caches the result of following loaders on disk (default) or in the database.
To begin, you'll need to install cache-loader:
npm install --save-dev cache-loader
Add this loader in front of other (expensive) loaders to cache the result on disk.
webpack.config.js
module.exports = {
module: {
rules: [
{
test: /\.ext$/,
use: ['cache-loader', ...loaders],
include: path.resolve('src'),
},
],
},
};
⚠️ Note that there is an overhead for saving the reading and saving the cache file, so only use this loader to cache expensive loaders.
| Name | Type | n Default | Description |
|---|---|---|---|
cacheContext | {String} | undefined | Allows you to override the default cache context in order to generate the cache relatively to a path. By default it will use absolute paths |
cacheKey | {Function(options, request) -> {String}} | undefined | Allows you to override default cache key generator |
cacheDirectory | {String} | findCacheDir({ name: 'cache-loader' }) or os.tmpdir() | Provide a cache directory where cache items should be stored (used for default read/write implementation) |
cacheIdentifier | {String} | cache-loader:{version} {process.env.NODE_ENV} | Provide an invalidation identifier which is used to generate the hashes. You can use it for extra dependencies of loaders (used for default read/write implementation) |
write | {Function(cacheKey, data, callback) -> {void}} | undefined | Allows you to override default write cache data to file (e.g. Redis, memcached) |
read | {Function(cacheKey, callback) -> {void}} | undefined | Allows you to override default read cache data from file |
readOnly | {Boolean} | false | Allows you to override default value and make the cache read only (useful for some environments where you don't want the cache to be updated, only read from it) |
webpack.config.js
module.exports = {
module: {
rules: [
{
test: /\.js$/,
use: ['cache-loader', 'babel-loader'],
include: path.resolve('src'),
},
],
},
};
webpack.config.js
// Or different database client - memcached, mongodb, ...
const redis = require('redis');
const crypto = require('crypto');
// ...
// connect to client
// ...
const BUILD_CACHE_TIMEOUT = 24 * 3600; // 1 day
function digest(str) {
return crypto
.createHash('md5')
.update(str)
.digest('hex');
}
// Generate own cache key
function cacheKey(options, request) {
return `build:cache:${digest(request)}`;
}
// Read data from database and parse them
function read(key, callback) {
client.get(key, (err, result) => {
if (err) {
return callback(err);
}
if (!result) {
return callback(new Error(`Key ${key} not found`));
}
try {
let data = JSON.parse(result);
callback(null, data);
} catch (e) {
callback(e);
}
});
}
// Write data to database under cacheKey
function write(key, data, callback) {
client.set(key, JSON.stringify(data), 'EX', BUILD_CACHE_TIMEOUT, callback);
}
module.exports = {
module: {
rules: [
{
test: /\.js$/,
use: [
{
loader: 'cache-loader',
options: {
cacheKey,
read,
write,
},
},
'babel-loader',
],
include: path.resolve('src'),
},
],
},
};
Please take a moment to read our contributing guidelines if you haven't yet done so.
The hard-source-webpack-plugin provides an intermediate caching step for modules. It is more comprehensive than cache-loader as it caches the entire module state, not just the loader results. This can lead to even faster builds, but it is also more complex to set up and maintain.
While babel-loader itself is not a caching solution, it can be used in conjunction with cache-loader to cache the results of Babel transpilation. This combination is often used to speed up the build process for JavaScript projects.
Webpack itself has built-in caching mechanisms starting from version 5. These built-in features can sometimes replace the need for cache-loader, offering a more integrated and potentially more efficient caching solution.
FAQs
Caches the result of following loaders on disk.
The npm package cache-loader receives a total of 256,630 weekly downloads. As such, cache-loader popularity was classified as popular.
We found that cache-loader demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 8 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.