Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
create-sourcebit
Advanced tools
An interactive setup process for Sourcebit
Sourcebit uses a configuration file of sourcebit.js
to define and configure all of its plugins. While this file can be created manually, this command-line interface provides an interactive setup that gathers enough information about the user's environment and content architecture to create a working configuration.
Every Sourcebit plugin must define the questions that should be asked and process the answers. This takes place via the getSetup
and getOptionsFromSetup
methods.
The list of plugins offered by the interactive setup process is pulled from the plugins.json
file in the root of the repository. It's an array of objects with the following properties:
module
(String): The name of the plugin's npm module
sourcebit-source-contentful
description
(String): A human-friendly description of the plugin
A Contentful source plugin for Sourcebit
author
(String): The name/handle of the plugin's author
John Doe <john.doe@example.com>
type
(enum: source|target
): The type of plugin
source
plugins.json
[
{
"module": "/Users/eduardoboucas/Sites/sourcebit-source-contentful",
"description": "A Contentful source plugin for Sourcebit",
"author": "Stackbit",
"type": "source"
},
{
"module": "/Users/eduardoboucas/Sites/sourcebit-target-jekyll",
"description": "A Sourcebit plugin for Jekyll",
"author": "Stackbit",
"type": "target"
}
]
You can create your own plugins.json
file and tell the setup process to use it. This is useful when you're developing a plugin locally and you want it to appear on the list of available plugins without having to publish it to the official registry.
To use a local plugin registry, create a file with the structure above and start the setup process with the --plugins
flag pointing to its path.
npx create-sourcebit --plugins=./my-plugins.json
FAQs
Create and configure a Sourcebit installation
The npm package create-sourcebit receives a total of 1 weekly downloads. As such, create-sourcebit popularity was classified as not popular.
We found that create-sourcebit demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 11 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.