Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
ember-package
Advanced tools
Package your ember-addons to be consumer by non Ember CLI Apps or consume ember-addons from your non ember-cli app
Disclaimer: This is just an experiment for now. Something we extracted from one of our internal add-ons, that is consumed by one of our non EmberCLI Apps. Please send us your feedback. The rest of the README explains the intention behind this, but most of it is not implented yet.
Ember Package helps add-on authors and add-on consumers by removing the need to use EmberCLI from non Ember CLI Applications. I think it's better to migrate the application to use Ember CLI, but this can help as an interim step. This is designed for add-ons consumed at runtime, not for add-ons that extend the build pipeline, add blueprints or commands.
NOTE: for an alternative, with a slightly different approach, check giftwrap. Giftwrap, builds multiple addons into a single set of JS and CSS files. It also let's you GiftWrap.install
the wrapped addons into your App, which ember-package doesn't do. However it offers no support for package authors.
Start by installing and initializing ember-package
npm install -g ember-package
ember-package init
Simply add the ember add-ons you want to consume to your non Ember CLI Application.
npm install ember-lgtm --save-dev
Running that, ember-package will detect the add-ons installed and will build static assets under ./ember-packages/
. From there, you can simply reference them from your application as needed. For example, we have an application using Ember EAK, so we simply add it to the index. In this case, ember-lgtm only has a Javascript file, so that's all we need to reference.
<script src="ember-packages/ember-lgtm/ember-lgtm.js"></script>
ember-package init
adds a postinstall hook to your package json to run ember-package
after installing node modules.
ember-package
will inspect your package.json for ember-addons. For all of the add-ons it finds, it will package them, leaving the output under ember-packages/package-name
. It will generate .js, .css.
It won't concatenate the dependencies of your add-on, since it doesn't know which of those are you referrering to already and it doesn't have a way of adding them dynamically to your current build pipeline. We could potentially add a warning if we identify bower.json dependencie if the app is using bower.
TODO: Describe how to npm link
an addon and run ember package --serve
to keep rebuilding as the addon code changes.
Start by installing ember-package as an add-on.
ember install ember-package
Run ember package
to build static assets for your add-on. You could then publish this assets for others to consume via bower or another package manager. This is similar to what ember does with components/ember
FAQs
Package your ember-addons to be consumer by non Ember CLI Apps or consume ember-addons from your non ember-cli app
The npm package ember-package receives a total of 1 weekly downloads. As such, ember-package popularity was classified as not popular.
We found that ember-package demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.