
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Easily package your Meteor apps with Electron, and butter.
npm install -g electrify
cd /your/meteor/app
electrify
Works on all Meteor's supported platforms.
$ electrify -h
Usage: electrify [command] [options]
Commands:
run (default) start meteor app within electrify context
bundle bundle meteor app at `.electrify` dir
package bundle and package app to `--output` dir
Options:
-h, --help output usage information
-V, --version output the version number
-i, --input <path> meteor app dir | default = .
-o, --output <path> output dir | default = .electrify/.dist
-s, --settings <path> meteor settings file | default = null (optional)
Examples:
# cd into meteor dir first
cd /your/meteor/app
electrify
electrify run
electrify package
electrify package -o /dist/dir
electrify package -o /dist/dir -s file.json
electrify package -i /app/dir -o /dist/dir -s dev.json
electrify package -- <electron-packager-options>
# more info about electron packager options:
# ~> https://www.npmjs.com/package/electron-packager
npm install -g electrify
For invoking Electron methods from Meteor, you'll also need to install the
arboleya:electrifymeteor package. For more info check Meteor x Electron integration.
cd /your/meteor/app
electrify
cd /your/meteor/app
electrify package
The packaging process is done under the hood using electron-packager
npm package. The following variables are automatically set:
--out -- comes from cli option [-o, --out]--arch -- comes from system [current arch]--platform -- comes from system [current platform]--version -- comes from .electrify/package.json [current app version]You can overwrite these default values and also set others by passing custom
arguments directly to electron-packager after --, i.e:
cd /your/meteor/app
electrify package -- --icon=/folder/x/img/icon.png --version=x.y.z
All the available options for electron-packager can be found here:
https://www.npmjs.com/package/electron-packager
The output app will match your current operational system and arch type.
Due to NodeJS native bindings of such libraries such as Fibers -- which are mandatory for Meteor, you'll need to have your Meteor app fully working on the desired platform before installing this plugin and packaging your app.
So, at this time, you cannot package your app in a cross-platform fashion from one single OS.
Perhaps you can live with it? :)
DO NOT use options to output for multiple arch/platforms at once, such as
--arch=all. It won't work, Electrify can bundle Meteor apps only for the platform you're running on.
-i, --input - Meteor app folder, default is current directory (process.cwd()).-o, --output - Sets output folder for your packaged app, default is
/your/meteor/app/.dist-s, --settings Sets path for Meteor
settings file, this will be
available inside your Meteor code both in development and after being packaged.You'll notice a new folder called .electrify in your meteor app dir, its
structure will be like this:
/your/meteor/app
├── .electrify
│ ├── .gitignore
│ ├── electrify.json
│ ├── index.js
│ └── package.json
├── .meteor
└── ...
This is a pure Electron project, so you can use the whole Electron API from JS
files in this folder. Also, you can install electron dependencies and store them
in the package.json file. Note that the electrify package is itself a
dependency.
See this folder as the desktop layer for your Meteor app. Remember to check
out the index.js file, it constains the electrify start/stop usage.
The electrify.json file will hold specific preferences for Electrify, such as
plugins and so on. It's still a WIP, but you can get around it.
electrify.json)For now there's only one option here: preserve_db.
Set it to true to preserve database between installs. It works by saving the mongo data dir inside user's data folder, instead of being self contained within the app folder (which gets deleted when new version is installed).
Let's see how one would be able to do a simple SplashScreen:
var app = require('app');
var browser = require('browser-window');
var electrify = require('electrify')(__dirname);
var window = null;
var splash = null; // splash variable
app.on('ready', function() {
splash = new browser({ // starts splash window
// >>> your configs here
});
splash.loadUrl('./splash.html'); // create the ".electrify/splash.html" file
// then move along and start electrify
electrify.start(function(meteor_root_url) {
// before opening a new window with your app, destroy the splash window
splash.close(); // >>> or .destroy(), check what works for you
// from here on, well, nothing changes..
window = new browser({
width: 1200, height: 900,
'node-integration': false // node integration must to be off
});
window.loadUrl(meteor_root_url);
});
});
// ....
You can seamlessly call Electron methods from your Meteor's client/server code.
Define your Electron methods inside the .electrify folder:
// `.electrify/index.js` file
electrify.methods({
'hello.world': function(firstname, lastname, done) {
// do things with electron api, and then call the `done` callback
// as ~> done(err, res);
done(null, 'Hello '+ firstname +' '+ lastname +'!');
}
});
Then, in your Meteor code (client and server), you can call this method like:
// Electrify.call(method_name, args, done_callback);
Electrify.call('hello.world', ['anderson', 'arboleya'], function(err, msg) {
console.log(msg); // Hello anderson arboleya!
});
IMPORTANT
You can only call methods after the connection is made between Meteor and Electron, to make sure it's ready you can wrap your code in a startup block:
Electrify.startup(function(){ Electrify.call(...); });
When upgrading to newer versions, it's important to know that:
Once these files exists on disk, they will not be overwritten.
.electrify/index.js.electrify/package.json.electrify/electrify.json.electrify/.gitignore.jsonAs these files above is never overwritten, in case of any API change that needs adjustments, these will have to be made manually.
Always keep the same electrify version in your Meteor, and inside the
.electrify folder, as per specified in .electrify/package.json file.
Do not open issues, use the chat channel instead.
This is very young and active software, so make sure your are always up to date before opening an issue. Follow the released fixes through the HISTORY.md file.
If you find any problem, please open a meaningful issue describing in detail how to reproduce the problem, which platform/os/arch type you're using, as well as the version of Meteor and Electrify, and any other info you may find usefull.
The MIT License (MIT)
Copyright (c) 2015 Anderson Arboleya
FAQs
Package your Meteor apps with Electron, and butter.
We found that electrify demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.