
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
The main Cocy package.
const cocy = new Cocy(options?);
See CocyOptions.ts.
Files are stored as a map at cocy.files. You can for example get a file by its absolute path using cocy.files.get(absolutePath).
The properties of each file object are described here.
// it's a map - don't forget `values`
for (const file of cocy.files.values()) {
console.log(file.attributes.title);
}
cocy.use()cocy.use(plugin, ...options?)
The plugin function will be invoked, allowing it to register hooks on the instance. The cocy instance will be passed as the first parameter, followed by all specified options.
cocy.find()Search for files and add them. Promise is fulfilled, once all files have been found and transformed by registered plugins.
cocy.resolveAsset()cocy.resolveAsset(asset, file, key?)
Resolve an asset using the asset resolver. If a key is specified, it will be added to the file's asset map and can be retrieved by using file.assets.get(key). See Assets below for more.
cocy.startWatcher()Start watching for file-system changes.
cocy.stopWatcher()Stop watching for file-system changes.
You can hook into events on the instance. See the Houk API docs for more info on event listeners.
cocy.on('fileAdded', (file: CocyFile) => {
// we got a new file!
console.log(file.slug);
});
| Event | Parameters | Description |
|---|---|---|
fileAdded | CocyFile | A new file was added. |
fileRemoved | CocyFile | A file was removed. |
fileUpdated | CocyFile | A file's content was changed. |
fileChanged | CocyFile | Any of the upper events occured to a file. |
assetAdded | CocyAsset, CocyFile, CocyAssetKey | A new asset was added. See Assets below for more. |
Allowing files to reference assets is often a basic requirement for content-based sites. For example, you might have a blog post like this in Markdown format:
I went to Hamburg last summer:

Let's use the image tag as an example. By default, the file URLs will be kept, resulting in <img src="./hamburg.jpg">. Depending on your environment, this might not be desirable. To transform the file URLs, you can listen for assetAdded events:
import path from 'path';
cocy.on('assetAdded', async (resolve, asset, file) => {
// here, asset is "./hamburg.jpg"
// file is the Cocy File object
if (asset.startsWith('./')) {
// it's a relative file path!
// use the file's path as a base
const absolute = path.join(file.path.absolute, '..', asset);
// in this example, we might want to use an image cdn
const url = await myCdn.upload(absolute);
// url might be https://cdn.photos/hamburg.jpg
resolve(url);
}
});
This would result in <img src="https://cdn.photos/hamburg.jpg">.
FAQs
The main Cocy package.
We found that cocy demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.