
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
The relevant directories are glass-react, glass-swc, and vscode-extension.
The other directories are irrelevant (babel-extension is not used, and www is a Next.js project that renders what you see on https://useglass.ai).
glass_swc.wasm to your config:// next.config.js
const nextConfig = {
experimental: {
swcPlugins: [
['glass-js/swc', {}],
],
}
}
Or if you want to use the development version on your own computer:
// next.config.js
const nextConfig = {
experimental: {
swcPlugins: [
['PATH/TO/glass/glass-swc/dist/glass_swc.wasm', {}],
],
}
}
<GlassProvider /> to your app.import GlassProvider from "glass-js";
Or if you want to use the development version on your own computer:
import GlassProvider from "PATH/TO/GlassProvider";
vscode-extension inside a separate VSCode window and pressing F5.To get started developing, run these steps:
Run pnpm install to install everything. We use pnpm instead of npm because we're a monorepo and pnpm is more efficient, but it works exactly the same as npm.
Run npm run build:all to build both the Glass React bar and the Nextjs swc plugin (this just runs npm run build in both folders).
You don't have to do anything more unless you want to edit the extension. If you want to edit the extension, cd into vscode-extension and run npm install (we disabled pnpm in vscode-extension because most vscode docs use npm instead).
You can publish two things:
Contents of the vscode extension (from vscode-extension) to the VSCode marketplace.
The <GlassProvider /> package (from glass-react) together with the SWC plugin (from glass-swc) to npm.
To publish vscode extension, it's like publishing any other vscode extension. Run vsce publish.
To publish the the npm package, run npm run publish. Make sure to increment the version number in the relevant package.json or you'll be rejected. Look at the command for more details, but in short it publishes only the built files.
FAQs
The relevant directories are `glass-react`, `glass-swc`, and `vscode-extension`.
We found that glass-js demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.