Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
gulp-esbuild
Advanced tools
A gulp plugin for the esbuild bundler.
There are two exports available: gulpEsbuild
and createGulpEsbuild
. In most cases you should use the gulpEsbuild
export. Use the createGuipEsbuild
export if you want to enable the esbuild's incremental build.
The esbuild's incremental build is used with the gulp's watching files API and allows you to rebuild only changed parts of code (example);
const {createGulpEsbuild} = require('gulp-esbuild')
const gulpEsbuild = createGulpEsbuild({
incremental: true, // enables the esbuild's incremental build
})
Esbuild doesn't fully support working with the virtual files which gulp send when you use: src(...).pipe(gulpEsbuild(...))
.
We found workaround using some tricks, but one limitation still remains. Every file you send via src(...)
must exist in the file system.
Its contents are not important, since they will be taken from the virtual file. But existence in the file system is required.
npm install gulp-esbuild esbuild
or
yarn add gulp-esbuild esbuild
gulpfile.js
const {
src,
dest,
} = require('gulp')
const gulpEsbuild = require('gulp-esbuild')
function build() {
return src('./index.tsx')
.pipe(gulpEsbuild({
outfile: 'bundle.js',
bundle: true,
loader: {
'.tsx': 'tsx',
},
}))
.pipe(dest('./dist'))
}
exports.build = build
package.json
...
"scripts": {
"build": "gulp build"
}
...
command line
npm run build
gulpfile.js
const {
src,
dest,
watch,
} = require('gulp')
const {createGulpEsbuild} = require('gulp-esbuild')
const gulpEsbuild = createGulpEsbuild({ incremental: true })
function build() {
return src('./src/index.js')
.pipe(gulpEsbuild({
outfile: 'outfile.js',
bundle: true,
}))
.pipe(dest('./dist'))
}
function watchTask() {
watch('./src/index.js', build)
}
exports.watch = watchTask
package.json
...
"scripts": {
"watch": "gulp watch"
}
...
command line
npm run watch
More examples here
Name | Type | Default |
---|---|---|
sourcemap | boolean|'linked'|'inline'|'external'|'both' | |
sourceRoot | string | |
sourcesContent | boolean | |
legalComments | 'none'|'inline'|'eof'|'linked'|'external' | |
format | 'iife'|'cjs'|'esm' | |
globalName | string | |
target | string | |
supported | object | |
mangleProps | RegExp | |
reserveProps | RegExp | |
mangleQuoted | boolean | |
mangleCache | object | |
drop | 'console'|'debugger' | |
dropLabels | array | |
minify | boolean | |
minifyWhitespace | boolean | |
minifyIdentifiers | boolean | |
minifySyntax | boolean | |
lineLimit | number | |
charset | 'ascii'|'utf8' | |
treeShaking | boolean | |
ignoreAnnotations | boolean | |
jsx | 'transform'|'preserve'|'automatic' | |
jsxFactory | string | |
jsxFragment | string | |
jsxImportSource | string | |
jsxDev | boolean | |
jsxSideEffects | boolean | |
define | object | |
pure | array | |
keepNames | boolean | |
banner | object | |
footer | object | |
color | boolean | |
logLevel | 'verbose'|'debug'|'info'|'warning'|'error'|'silent' | 'silent' |
logLimit | number | |
logOverride | object | |
tsconfigRaw | string |object | |
bundle | boolean | |
splitting | boolean | |
preserveSymlinks | boolean | |
outfile | string | |
metafile | boolean | |
metafileName | string | 'metafile.json' |
outdir | string | |
outbase | string | |
platform | 'browser'|'node'|'neutral' | |
external | array | |
packages | 'external' | |
alias | object | |
loader | object | |
resolveExtensions | array | |
mainFields | array | |
conditions | array | |
tsconfig | string | |
outExtension | object | |
publicPath | string | |
entryNames | string | |
chunkNames | string | |
assetNames | string | |
inject | array | |
plugins | array |
FAQs
gulp plugin for esbuild bundler
The npm package gulp-esbuild receives a total of 6,858 weekly downloads. As such, gulp-esbuild popularity was classified as popular.
We found that gulp-esbuild demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.