
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
esbuild-plugin-wasm-pack
Advanced tools
An esbuild plugin that runs wasm-pack before each build.
*Make sure you have wasm-pack installed and in your PATH.*
npm install --save-dev esbuild-plugin-wasm-pack
or
yarn add --dev esbuild-plugin-wasm-pack
Simply add it to your esbuild plugins list
// build.ts
import esbuild from 'esbuild';
import wasmpack from 'esbuild-plugin-wasm-pack';
esbuild.build({
...
plugins: [
wasmpack({
// options (see below)
})
]
...
});
The configuration options match the arguments to wasm-pack build.
| Option | Type | Default Value | Description |
|---|---|---|---|
logLevel | string | "info" | The maximum level of messages that should be logged by wasm-pack. Possible values: info, warn, error |
profile | string | "dev" | Sets the build profile Options:
|
noTypescript | boolean | false | By default a *.d.ts file is generated for the generated JS file. This flag will disable generating this TypeScript file. |
mode | string | "normal" | Sets steps to be run. Possible values: no-install, normal, force |
outDir | string | "pkg" | Sets the output directory with a relative path. |
outName | string | <package name> | Sets the output file names. Defaults to package name. |
scope | string | - | The npm scope to use in package.json, if any. |
target | string | "bundler" | Sets the target environment. Possible values: bundler, nodejs, web, no-modules |
path | string | - | The path to the Rust crate. If not set, searches up the path from the current directory. |
extraOptions | string[] | [] | A list of extra options to pass to cargo build. |
extraPackOptions | string[] | [] | A list of extra options to pass to wasm-pack |
wasmPackPath | string | - | Overrides the path to the wasm-pack executable. This can also be set via the WASM_PACK_PATH environment variable. |
This project is licensed under the MIT License - see the LICENSE.md file for details.
FAQs
An esbuild plugin that runs wasm-pack.
The npm package esbuild-plugin-wasm-pack receives a total of 13 weekly downloads. As such, esbuild-plugin-wasm-pack popularity was classified as not popular.
We found that esbuild-plugin-wasm-pack demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.