
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
elm-webpack-loader
Advanced tools
Webpack loader for the Elm programming language.
It is aware of Elm dependencies and tracks them. This means that in watch
mode, if you require an Elm module from a Webpack entry point, not only will
that .elm file be watched for changes, but any other Elm modules it imports will
be watched for changes as well.
$ npm install --save elm-webpack-loader
Documentation: rules
webpack.config.js:
module.exports = {
module: {
rules: [{
test: /\.elm$/,
exclude: [/elm-stuff/, /node_modules/],
use: {
loader: 'elm-webpack-loader',
options: {}
}
}]
}
};
See the examples section below for the complete webpack configuration.
You can add cwd=elmSource to the loader:
var elmSource = __dirname + '/elm/path/in/project'
...
use: {
loader: 'elm-webpack-loader',
options: {
cwd: elmSource
}
}
...
cwd should be set to the same directory as your elm.json file. You can use this to specify a custom location within your project for your elm files. Note, this
will cause the compiler to look for all elm source files in the specified directory. This
approach is recommended as it allows the compile to watch elm.json as well as every file
in the source directories.
Set this to true to compile bundle in optimized mode. See https://elm-lang.org/0.19.0/optimize for more information.
...
use: {
loader: 'elm-webpack-loader',
options: {
optimize: true
}
}
...
Set this to true to enable Elm's time traveling debugger.
...
use: {
loader: 'elm-webpack-loader',
options: {
debug: true
}
}
...
undefined)This allows you to control aspects of how elm make runs with GHC Runtime Options.
The 0.19 version of elm make supports a limited set of those options, the most useful of which is
for profiling a build. To profile a build use the settings runtimeOptions: '-s', which will print
out information on how much time is spent in mutations, in the garbage collector, etc.
Note: Using the flags below requires building a new elm make binary with -rtsopts enabled!
If you notice your build spending a lot of time in the garbage collector, you can likely optimize it
with some additional flags to give it more memory, e.g. -A128M -H128M -n8m.
...
use: {
loader: 'elm-webpack-loader',
options: {
runtimeOptions: ['-A128M', '-H128M', '-n8m']
}
}
...
elm make allows you to specify multiple modules to be combined into a single bundle
elm make Main.elm Path/To/OtherModule.elm --output=combined.js
The files option allows you to do the same within webpack
module: {
loaders: [
{
test: /\.elm$/,
exclude: [/elm-stuff/, /node_modules/],
loader: 'elm-webpack-loader',
options: {
files: [
path.resolve(__dirname, "path/to/Main.elm"),
path.resolve(__dirname, "Path/To/OtherModule.elm")
]
}
}
]
}
(Note: It's only possible to pass array options when using the object style of loader configuration.)
You're then able to use this with
import Elm from "./elm/Main";
Elm.Main.init({node: document.getElementById("main")});
Elm.Path.To.OtherModule.init({node: document.getElementById("other")});
Hot module reloading is supported by installing elm-hot-webpack-loader and adding it to your list of loaders. It should look something like this:
module: {
rules: [
{
test: /\.elm$/,
exclude: [/elm-stuff/, /node_modules/],
use: [
{ loader: 'elm-hot-webpack-loader' },
{ loader: 'elm-webpack-loader' }
]
}
]
}
IMPORTANT: elm-hot-webpack-loader must be placed in the list immediately before elm-webpack-loader.
All options are sent down as an options object to node-elm-compiler. For example, you can
explicitly pick the local elm binary by setting the option pathToElm:
...
use: {
loader: 'elm-webpack-loader',
options: {
pathToElm: 'node_modules/.bin/elm'
}
}
...
For a list all possible options, consult the source.
You can find an example in the example folder.
To run:
npm install
npm run build
You can have webpack watch for changes with: npm run watch
You can run the webpack dev server with: npm run dev
For a full featured example project that uses elm-webpack-loader see pmdesgn/elm-webpack-starter .
Webpack can complain about precompiled files (files compiled by elm make).
You can silence this warning with
noParse. You can see it in use
in the example.
module: {
rules: [...],
noParse: [/.elm$/]
}
compiler.watching instead of compiler.options.watch as the latter doesn't work with the dev server.optimize and debug flags are now set by default depending on the webpack mode.forceWatch to force watch modeMake live reloading work more reliably
Added maxInstances for limiting of instances
Watching is now done based on elm-package.json, faster startup time via @eeue56
Add support for --debug via node-elm-compiler
Allow version bumps of node-elm-compiler.
Upgrade to latest node-elm-compiler, which fixes some dependency tracking issues.
Fix potential race condition between dependency checking and compilation.
Use node-elm-compiler 4.0.1+ for important bugfix.
Use node-elm-compiler 4.0.0+
Pass a real error object to webpack on failures.
Support Elm 0.17, and remove obsolete appendExport option.
Change warn to be a pass-through compiler flag rather than a way to specify
logging behavior.
Initial stable release.
FAQs
Webpack loader for the Elm programming language.
The npm package elm-webpack-loader receives a total of 5,217 weekly downloads. As such, elm-webpack-loader popularity was classified as popular.
We found that elm-webpack-loader demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.