Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
esbuild-plugin-replace
Advanced tools
🚀 A Esbuild plugin which replaces targeted strings in files while bundling
This package is based on @rollup/plugin-replace
using npm:
npm install esbuild-plugin-replace --save-dev
using yarn:
yarn add esbuild-plugin-replace -D
const { build } = require('esbuild');
const { replace } = require('esbuild-plugin-replace');
build({
// other build options
plugins: [
replace({
'__buildVersion': '"1.0.0"',
'__author__': `'naecoo'`
})
]
});
The configuration above will replace every instance of __buildVersion
with "1.0.0"
and __author
with 'naecoo'
Note: Values must be either primitives (e.g. string, number) or function
that returns a string. For complex values, use JSON.stringify
. To replace a target with a value that will be evaluated as a string, set the value to a quoted string (e.g. "test"
) or use JSON.stringify
to preprocess the target string safely.
In addition to the properties and values specified for replacement, users may also specify the options below.
include
Type: RegExp
default: /.*/
Filters files that do not match RegExp expressions. By default all files are matched.
exclude
Type: RegExp
default: null
Filters files that do match the exclude
RegExp expressions. When include
and exclude
are set at the same time, include
is used first, and exclude
doesn't work.
values
Type: { [key: String]: Replacement }
, where Replacement
is either a string or a function
that returns a string.
Default: {}
To avoid mixing replacement strings with the other options, you can specify replacements in the values
option. For example, the following signature:
replace({
include: /\.js$/,
changed: "replaced"
});
Can be replaced with:
replace({
include: /\.js$/,
values: {
changed: "replaced"
}
});
delimiters
Type: Array[String, String]
Default: ['\b', '\b']
Specifies the boundaries around which strings will be replaced. By default, delimiters are word boundaries. See Word Boundaries below for more information.
FAQs
Replace strings in files while bundling
We found that esbuild-plugin-replace demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.