
Security News
OWASP 2025 Top 10 Adds Software Supply Chain Failures, Ranked Top Community Concern
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.
gobble-unpackage
Advanced tools
Use only the needed files from NPM/SPM/CommonJS modules in your GobbleJS workflow
Use only the needed files from NPM/SPM/CommonJS modules in your GobbleJS workflow.
There are a myriad of javascript package managers our there: Bower, NPM, JSPM, SPM, Volo, Meteor, Composer and so on.
The goal of gobble-unpackage is allowing you, the web developer, to use any
of these package managers, then use GobbleJS to filter out the files you don't
need, keeping only those specified in the package.json definition.
It also does some magic to the existing sourcemaps, so longer paths (including the module name) will be shown in the final files.
I assume you already know the basics of Gobble.
npm i -D gobble-unpackage
In your gobblefile, run the package gobble transform, like so:
var gobble = require( 'gobble' );
module.exports = gobble( directory_with_a_javascript_package ).transform( 'unpackage' );
The output node will contain only the files described by the main property of
the package.json file in the package. CSS and Less are managed, as well as
the SPM format for package.json.
If you want to override any values of the package's package.json, specify those
overrides as options to the 'unpackage' transform:
module.exports = gobble( directory_with_a_javascript_package )
.transform( 'unpackage', { main: './build/foobar.js' });
The output will include sourcemap files. If these are giving any problems, specify
the option stripSourcemaps with a truthy value. This will strip any existing
sourcemaps and replace them with a fake inline sourcemap pointing to the original
file. Use this option if you would like to completely ignore sourcemaps from
the module's author.
module.exports = gobble( directory_with_a_javascript_package )
.transform( 'unpackage', { stripSourcemaps: true });
A more ellaborate example, to concatenate some JS libraries:
npm install jquery
npm install bootstrap
npm install leaflet
var gobble = require( 'gobble' );
var libs = gobble([
gobble('node_modules/leaflet' ).transform('unpackage'),
gobble('node_modules/jquery' ).transform('unpackage'),
gobble('node_modules/bootstrap').transform('unpackage', {
main: './dist/js/bootstrap.js'
})
]);
var libJS = libs.transform('concat', { dest: 'libs.js', files: '**/*.js' });
var libCSS = libs.transform('concat', { dest: 'libs.css', files: '**/*.css' });
module.exports = gobble([ libJS, libCSS ]);
gobble-unpackage will not:
require() calls as some CommonJS modules expect.js in the filename of for the main property"THE BEER-WARE LICENSE":
<ivan@sanchezortega.es> wrote this file. As long as you retain this notice you
can do whatever you want with this stuff. If we meet some day, and you think
this stuff is worth it, you can buy me a beer in return.
FAQs
Use only the needed files from NPM/SPM/CommonJS modules in your GobbleJS workflow
We found that gobble-unpackage demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.