
Security News
OWASP 2025 Top 10 Adds Software Supply Chain Failures, Ranked Top Community Concern
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.
cdnupCDNup is a simple wrapper around pkgcloud which allows for a simple uploading
interface as well as the ability to define a CDN URL that fronts whereever you
are uploading your assets to.
npm install --save cdnup
You can refer to BFFS to see cdnup in action. In all examples below we
assume that you've already required and initialized the module as followed:
'use strict';
const CDNUp = require('cdnup');
const cdnup = new CDNUp('bucket-name', {
//
// It is still assumed that the `bucket-name` prefix is appended to the
// following url
//
url: 'https://myCdnEndpoint.com',
pkgcloud: { /* Pkgcloud config options */ }
});
As you can see in the example above we allow 2 arguments in the constructor:
bucket: The relative path to the files on the CDN server.options: Optional configuration object. The following keys are supported:sharding: Randomly select one of the supplied urls of the CDN so assets
can be sharded between different DNS/subdomains.url/urls: A url string or urls array for what you will use to publicly
fetch assets from the CDN.subdomain: Boolean indicating the bucket should be used as subdomain.pkgcloud: Options passed to pkgcloud constructor.mime: Object containing custom mime types per file type.check: Used to validate asset URL if the CDN assets are behind a firewall.We use pkgcloud in order to upload CDN assets. It supports most if
not all cloud providers depending on what you use and who you want to trust with
your assets. Check out the documentation and our sample config to see how you
may set this up for you.
const cdnup = new CDNUp('ux/core', {
pkgcloud: {
provider: 'amazon', // Use AWS s3
forcePathBucket: // Inform AWS to use `s3ForcePathStyle`
//...
}
});
Note: more information about forcePathBucket is available in AWS
documentation.
The following API methods are available.
This is the method that you will be using the most, upload. When you first
call the method it might take a second to work because it will first create the
bucket if that has not already been done
Once initialized, it will write the files to the cloud provider and call your supplied callback. It requires 3 arguments:
path.join'ed
with the root argument of the constructor.cdnup.upload('/path/to/file.js', 'file.js', function (err) {
if (err) return console.error('Shits on fire yo.');
console.log('all good');
});
Initialize the cloud provider with the given bucket-name passed to the
constructor.
cdnup.init(function (err) {
if (err) console.error('failed to mount cdn');
});
Return the URL and path of the CDN.
const fullCDNPath = cdnup.url();
Return the URL of the file specified against the configured check.
const cdn = new CDNUp('my-bucket', {
check: 'https://my-bucket.s3.amazonaws.com/',
url: 'https://whatever.com/world'
});
// Will be rewritten against the specific `check`.
const fileURL = cdn.checkUrl('https://whatever.com/world/hello-fixture.js');
Run AWS local, pull latest localstack.
This requires docker [to be setup][docker].
docker pull localstack/localstack:latest
npm run localstack
Finally, run the unit test.
npm test
FAQs
CDN Uploading for everyone
The npm package cdnup receives a total of 5 weekly downloads. As such, cdnup popularity was classified as not popular.
We found that cdnup demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.