
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
cyc provides an intuitive and hassle-free starting point for Cycle.js applications. It comes with production and development webpack configurations, dynamic hot reloading, Babel transpilation, unintrusive long-term caching, and an isomorphic express server. The cyc boilerplate is scalable, convenient, and highly modular.
$ npm install -g cyc-cli babel-cli
Run cyc in any directory, and you will be prompted for the name of your project, and what directory to put it in. The directory name defaults to the project name.
$ cyc
Application Name myapp
Directory (myapp)
Copying...
Populating...
Done.
$ cd myapp
$ npm i
Then, you can run the server in development.
$ npm run dev
Have a look in ./src/js/ and play around with the files. An index page with a BMI calculator and a simple about page are automatically generated. Each file is hot reloadable.
You can also build the server and run it in production. Compiling the client bundles may take a while, because this build step utilizes heavy optimization.
$ npm run mk
$ PORT=80 npm start
Note: When actually hosting a live website, you should change ::1 to 0.0.0.0 or ::.
dev start dev serverstart start production server (requires built server and client)mkserver build production server (fast)mkclient build production client (slow)mk build production server and clientcyc has some special plumbing that allows much of its code to be flexible and freely run in dev or production, client or server. This feature required close attention to details during the design process.
In development, the server is run entirely with babel-node, provided by babel-cli. In production, the server (output by the mkserver build step) is run with the default node installation. Application modules, or programs, are parsed with an isolated babel-registered require. Entry-level modules can check the global CLIENT variable to determine whether to use server or client logic. This is set to false on the server with global.CLIENT = false, while the webpack configuration sets it to true with a DefinePlugin.
Allowing the server to be built for production is one of the main design goals, but due to webpack's poor support for dynamic requires (i.e. require(variable)), some special tooling is required. The dynamic-require package provides dynamic requires, and supports babel transpilation.
For each request, the program is run, and its virtual DOM output is rendered and wrapped in an HTML template. A reference to the actual bundle is then placed at the end of the file. When the response reaches the client, the rendered content is immediately available while the program is loading. Once loaded, the program will bootstrap itself, and the application will be responsive.
The server can hot reload modules for server-side rendering, just as the client can with webpack-hmr. Implemented in hot.js, the reloading mechanism hooks into the webpack compiler object in the same way that webpack-hot-middleware does. When a program dependency is modified, invalidation is trickled down the tree all the way to the entry-level module. Invalidated modules are deleted from the require cache, and re-required with dynamic-require, making the updated version of the program available.
Routes are configured in the routes.js file. Each configurable route contains a reference to the index file of its respective program, pug (formerly jade) template, and route path. These routes are then transformed to normalize paths and add compilation metadata for webpack. Each route is then linked to the server request handler. The routing configuration can be customized to make other specific logic available in the request handler.
The server contains a hashes object that maps route IDs to their respective bundles. In development, this is reloaded in memory whenever a new compilation is performed. In production, the hashes are read from the hashes.json file produced by the mkclient build step.
FAQs
A fully featured Cycle.js starter.
We found that cyc-cli demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.