
Security News
PodRocket Podcast: Inside the Recent npm Supply Chain Attacks
Socket CEO Feross Aboukhadijeh discusses the recent npm supply chain attacks on PodRocket, covering novel attack vectors and how developers can protect themselves.
A plugin for both browserify and depsify, to allow to add dependencies not detected from code.
In the following example,
entry.css
depends upon entry-deps.css
,
and extra.css
upon extra-deps.css
.
We can make entry.css
depends on extra.css
using this plugin.
var reduce = require('reduce-css')
var path = require('path')
var b = reduce.create(
'entry.css',
{ basedir: path.join(__dirname, 'src') },
'bundle.css'
)
b.plugin('deps-patch')
b.bundle().pipe(b.dest(path.join(__dirname, 'build')))
// add dependencies
setTimeout(function () {
b.emit('deps-patch.update', [
// it claims that entry.css should depend on extra.css
// even if entry.css does not do it in the code
{ file: 'entry.css', deps: ['extra.css'] },
])
}, 200)
The result would be something like:
.entry-deps{} /* from entry-deps.css */
.extra-deps{} /* from extra-deps.css */
.extra{} /* from extra.css */
.entry{} /* from entry.css */
The deps-patch.update
event should be fired whenever you want to add new dependencies.
b.plugin('deps-patch')
b.emit('deps-patch.update', depsPatch)
depsPatch
is an array of rows.
A row
is just an object with fields:
file
: String
. the file path to the dependentdeps
: Array
. an array of file path to modules the dependent should depend upon.FAQs
Allow to add dependencies not detected from code
We found that deps-patch demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Socket CEO Feross Aboukhadijeh discusses the recent npm supply chain attacks on PodRocket, covering novel attack vectors and how developers can protect themselves.
Security News
Maintainers back GitHub’s npm security overhaul but raise concerns about CI/CD workflows, enterprise support, and token management.
Product
Socket Firewall is a free tool that blocks malicious packages at install time, giving developers proactive protection against rising supply chain attacks.