
Research
/Security News
Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.
common-shakeify
Advanced tools
browserify tree shaking plugin based on common-shake, the CommonJS tree shaker originally by @indutny.
Comments out unused exports from CommonJS modules.
With input files:
// math.js
exports.min = function (a, b) { return a < b ? a : b }
exports.max = function (a, b) { return a < b ? b : a }
// app.js
var math = require('./math')
console.log(math.max(10, 20))
This plugin will rewrite the files to:
// math.js
/* common-shake removed: exports.min = */ void function (a, b) { return a < b ? a : b }
exports.max = function (a, b) { return a < b ? b : a }
// app.js
var math = require('./math')
console.log(math.max(10, 20))
Use a minifier on the output to remove the exports entirely.
npm install --save-dev common-shakeify
With the browserify cli:
browserify -p common-shakeify /my/app.js > bundle.js
# Minify
uglify-js bundle.js --compress > bundle.min.js
With the browserify Node API:
var commonShake = require('common-shakeify')
var b = browserify({ entries: '/my/app.js' })
.plugin(commonShake, { /* options */ })
.bundle()
// Minify & save
var uglify = require('minify-stream')
b
.pipe(uglify())
.pipe(fs.createWriteStream('bundle.min.js'))
Note that using a minifier transform like uglifyify doesn't eliminate the commented-out exports. Transforms run before common-shakeify, so you have to use a minifier on the final bundle to remove the unused exports.
verbose, vWhen true, print messages to stderr when exports are deleted, or the tree-shaker bails out on a module.
Default false.
The verbose flag only works when no custom handlers are passed, so if you're using eg. a custom onExportDelete you have to print these messages manually.
$ browserify -p [ common-shakeify -v ] app.js > bundle.js
common-shake: removed `decode` in node_modules/vlq/dist/vlq.js:10:7
common-shake: bailed out: `module.exports` assignment in node_modules/process-nextick-args/index.js:20:3
onExportDelete(filename, exportName)Handler called for every exported identifier that is being removed.
filename is the path to the file that exports the identifier. exportName is the name of the identifier. Return false to bail and keep the identifier.
onModuleBailout(module, reasons)Handler called when a module cannot be tree-shaked for some reason.
module is the Module object from common-shake.
reasons is an array of reasons that caused this module to be deoptimised.
onGlobalBailout(reasons)Handler called when tree-shaking is skipped entirely, usually because there is a dynamic require call in the source.
reasons is an array of reasons for skipping tree-shaking.
ecmaVersionParse with this ecmaVersion as interpreted by acorn. (default: 10)
FAQs
browserify tree shaking plugin using @indutny common-shake
The npm package common-shakeify receives a total of 21,256 weekly downloads. As such, common-shakeify popularity was classified as popular.
We found that common-shakeify demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 39 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.