Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
connect-bower
Advanced tools
Middleware for serving content from bower packages.
Scratching my own itch really. We use bower for packaging all of our front-end resources, and we wanted a simple and consistent way to access these packages from a browser.
Simple. When connect-bower
get's hit with a correctly formatted URL it will download (if needed) the correct package (versioned) and then serve any file from within this package.
The absolutely simplest way to use the middleware looks like this:
require("connect")()
.use(require("connect-bower")())
.listen(8080);
The general match rule for path is /:package/:version/:path
where
:package
is a bower package name:version
is a semver version or range or a straight up SHA1 commit:path
is a path to any file in the package/troopjs/2.1.0/package.json
Serve the file package.json
from the package troopjs
version 2.1.0
/troopjs/*/package.json
Serve the file package.json
from the package troopjs
of the latest version available
/troopjs/~2/package.json
Serve the file package.json
fro the package troopjs
of the latest version matching ~2
/troopjs/develop/package.json
Serve the file package.json
from the package troopjs
in the develop
branch
/troopjs/7703e4912c46abd81f32aad9886f19fc3c1a1f2c/package.json
Serve the file package.json
from the package troopjs
as in commit 7703e4912c46abd81f32aad9886f19fc3c1a1f2c
FAQs
Bower middleware
The npm package connect-bower receives a total of 0 weekly downloads. As such, connect-bower popularity was classified as not popular.
We found that connect-bower demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.