
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
dn-nuxt-config
Advanced tools
This package adds a number of common optimisations to the nuxt default config:
NUXT_DISABLE_OVERLAY=true)yarn add dn-nuxt-config --dev
Add dn-nuxt-config to buildModules section of nuxt.config.js
{
buildModules: [
'dn-nuxt-config'
]
}
You can configure and disable/enable many behaviours with custom module config.
The settings are documented below with their default values. If you do not define any settings, the default will always apply.
{
buildModules: [
['dn-nuxt-config', {
eslint: true, // Set to `false` to disable stylelint checks and output in webpack
stylelint: true, // Set to `false` to disable stylelint checks and output in webpack
objectFitPolyfill: false, // Enable to add a javscript/css object-fit polyfill for older browsers: https://github.com/bfred-it/object-fit-images
measure: false, // Enabling outputs build time from https://github.com/stephencookdev/speed-measure-webpack-plugin
boost: false, // Enabling sets experimental nuxt performance-improvements (dev-only)
useBabelRc: false, // Loads a `.babelrc` file with config, rather than using only what's defined in your `nuxt.config.js` and the default nuxt preset.
skipLodashPlugin: false // Set to `true` to disable lodash bundle size optimisation. Only disable this if you're NOT using lodash in your project
babelBrowserListsForLegacy: true // Enabling overrides the nuxt default browser support for your "legacy" client bundle (ie: 9) with a list of browsers from a browserslist-compatible config in your project: https://browsersl.ist/
babelBrowserListsForLegacy: true // Enabling overrides the default browser support for your "modern" client bundle (esmodule: true) with a list of browsers esmodule-compatible browsers from a browserslist-compatible config: https://browsersl.ist/
}]
]
}
Some modules are loaded with a default config, refer to their README for customisation:
This module provides a convenience option to disable the default webpack error overlay easily using an enviroment variable.
If you set this globally on your system (eg ~/.profile or ~/.bashrc) it will disable the overlay across all your projects
which apply this module.
Usage;
NUXT_DISABLE_OVERLAY=true yarn dev.
If you want to disable the overlay for everyone in your project (not recommended) you can use the vanilla nuxt option;
nuxt.config.js
export default {
[...]
build: {
friendlyErrors: false
}
}
Nuxt ships with the following default babel config:
modern: true or modern: client is set in your nuxt.config.js)If enabled, modern browsers with module support will always load the modern bundle.
You can override any of these settings by defining an override for build.babel.presets in your config.
This module attempts to make some of the workarounds to use browserslist configs easier, but you can still override with your custom presets or browser targets.
Any custom presets config in your nuxt.config.js will always override any settings changed by this module
When enabled with the default config, this module replaces some of the babel config outlined above to use a browserslist configured in your project.
A "client" (legacy) bundle optimized for IE9 and later With a config which will load a list of browsers to support from a "browserslist"-config in your project. This config will usually live inside your
package.jsonor a dedicated.browserslistrcfile in your root folder.
A "client" modern bundle, with support for any browser with esmodule support The modern bundle will be build for a subset of your browserslist: Only browsers in your browserslist which support esmodules.
Note: Your own config will always take priority over the browserslist defaults. You can mix-and-match or override the targets with custom config even if you use
babelBrowsersListForXXX: true
babelBrowserListsForLegacy: false: This will give you a larger "legacy" bundle, which will not however be loaded into any of your supported browsersbabelBrowserListsForModern: true: This will give you a smaller "modern" bundle for your supported browsers, since you are only supporting a subset of the default target for this buildbabelBrowserListsForLegacy: true: This will give you a smaller "legacy" bundle, since you are likely working with more recent browsers than the default ie: 9babelBrowserListsForModern: true: This will support a subset of the browsers in your browserslist which have esmodule support and make this bundle smaller for thembabelBrowserListsForLegacy: false and babelBrowserListsForModern: falsenuxt.config.js or use the nuxt defaultsYou can add a polyfill to support the CSS object-fit rule in older browsers. It is disabled by default.
Install the polyfill:
yarn add object-fit-images
Enable it in your nuxt.config.js
{
buildModules: [
['dn-nuxt-config', { objectFitPolyfill: true }]
]
}
See CHANGELOG.md
Please submit contributions through a merge request.
All commits on this repository MUST comply with the Conventional Commits Standard.
Running yarn install on your local machine should enforce all local commits to adhere to this standard.
If you're new to conventional commits you're encouraged to use Comittizen to learn the ropes.
Only package maintainers should release new versions.
A changelog is automatically maintained using standard-version.
Run yarn run release to bump/tag the version, generate the changelog and immediately publish the next release
note: Don't fill out the version number in the prompt. Just immediatly press "enter". This is because
yarn run releaseis a combination ofstandard-versionand vanilla yarnpublish, where the latter will prompt you for a new version whichstandard-versionhas already incremeted automatically.
FAQs
Extends default nuxt config with some useful optimisations
We found that dn-nuxt-config demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.