Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
generator-joplin
Advanced tools
Scaffolds out a new Joplin plugin
First, install Yeoman and generator-joplin using npm (we assume you have pre-installed node.js).
npm install -g yo
npm install -g generator-joplin
Then generate your new project:
yo joplin
To test the generator for development purposes, follow the instructions there: https://yeoman.io/authoring/#running-the-generator This is a template to create a new Joplin plugin.
The main two files you will want to look at are:
/src/index.ts
, which contains the entry point for the plugin source code./src/manifest.json
, which is the plugin manifest. It contains information such as the plugin a name, version, etc.The plugin is built using Webpack, which creates the compiled code in /dist
. A JPL archive will also be created at the root, which can use to distribute the plugin.
To build the plugin, simply run npm run dist
.
The project is setup to use TypeScript, although you can change the configuration to use plain JavaScript.
To publish the plugin, add it to npmjs.com by running npm publish
. Later on, a script will pick up your plugin and add it automatically to the Joplin plugin repository as long as the package satisfies these conditions:
package.json
, the name starts with "joplin-plugin-". For example, "joplin-plugin-toc".package.json
, the keywords include "joplin-plugin".publish/
directory, there should be a .jpl and .json file (which are built by npm run dist
)In general all this is done automatically by the plugin generator, which will set the name and keywords of package.json, and will put the right files in the "publish" directory. But if something doesn't work and your plugin doesn't appear in the repository, double-check the above conditions.
To update the plugin framework, run npm install -g generator-joplin && yo joplin --update
Keep in mind that doing so will overwrite all the framework-related files outside of the "src/" directory (your source code will not be touched). So if you have modified any of the framework-related files, such as package.json or .gitignore, make sure your code is under version control so that you can check the diff and re-apply your changes.
For that reason, it's generally best not to change any of the framework files or to do so in a way that minimises the number of changes. For example, if you want to modify the Webpack config, create a new separate JavaScript file and include it in webpack.config.js. That way, when you update, you only have to restore the line that include your file.
A plugin that uses content scripts must declare them under the content_scripts
key of manifest.json.
Each entry must be a path relative to /src, and without extension. The extension should not be included because it might change once the script is compiled. Each of these scripts will then be compiled to JavaScript and packaged into the plugin file. The content script files can be TypeScript (.ts or .tsx) or JavaScript.
For example, assuming these files:
/src
index.ts # Main plugin script
myContentScript.js # One content script (JS)
otherContentScript.ts # Another content script (TypeScript)
vendor/
test.ts # Sub-directories are also supported
The manifest.json
file would be:
{
"manifest_version": 1,
"name": "Testing Content Scripts",
content_scripts: [
"myContentScript",
"otherContentScript",
"vendor/test"
]
}
Note in particular how the file path is relative to /src and the extensions removed.
MIT © Laurent Cozic
FAQs
Scaffolds out a new Joplin plugin
The npm package generator-joplin receives a total of 16 weekly downloads. As such, generator-joplin popularity was classified as not popular.
We found that generator-joplin demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.