Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Only pass through files once unless changed
Similar to plugins such as gulp-cache, gulp-changed, and gulp-newer, except it doesn't care about your dest/build files and it will still persist your "cache" (unless you don't want it to) across Gulp runs. Also makes it easy to manage what files are filtered since data is stored in a easily readable JSON file.
$ npm install gulp-once --save-dev
var gulp = require('gulp'),
once = require('gulp-once'),
someExpensiveOperation = require('some-expensive-operation');
gulp.task('default', function() {
gulp.src('src/**/*')
.pipe(once()),
.pipe(someExpensiveOperation())
.pipe(gulp.dest('dest'));
});
gulp.src('src/**/*')
.pipe(once({
context: process.cwd(),
namespace: false,
algorithm: 'sha1',
file: '.checksums',
fileIndent: 4
})),
.pipe(someExpensiveOperation())
.pipe(gulp.dest('dest'));
options.context
[string|boolean]: Sets the path used for calculating all files' relative path, which is then used as the hash key in your checksums file. If you only wish to store filenames without their path, you can set this option to false
. Default: process.cwd()
gulp.src('src/img/*')
.pipe(once('images')),
.pipe(someExpensiveOperation())
.pipe(gulp.dest('dest/img'));
options.namespace
[string|function|boolean]: If you want to separate pools/namespaces of hashes for different tasks within the same checksums
file, you can assign a namespace for a specific stream. You can also provide a function that dynamically sets the namespace per file—this function will be passed a copy of the file vinyl file object being checked. Default: false
If you do not pass an object as an option to once()
, it will be passed to this setting.
gulp.src('src/img/*')
.pipe(once('images')),
.pipe(someExpensiveOperation())
.pipe(gulp.dest('dest/img'));
options.algorithm
[string]: Whatever you would want passed to crypto.createHash()
Default: 'sha1'
options.file
[string|boolean]: Path to file to persist data as JSON between Gulp runs. Is useful for retaining file details if Gulp exits unexpectedly and you have to restart, if you run tasks manually (i.e. You don't gulp.watch()
files), or to just not run unnecessary actions between work sessions. Also allows you to easily "cache bust" for specific files easily if you are so inclined. Can be set to false
to store data in memory, this effectively turns off persistance as a file will not be created/updated with any file changes. Default: '.checksums'
gulp.src('src/img/*')
.pipe(once({file: 'path/to/file.json'})),
.pipe(someExpensiveOperation())
.pipe(gulp.dest('dest/img'));
options.fileIndent
[int]: If you're a stickler for spacing on your files, you can set the indentation for the checksumed files. Has no effect if options.file
is set to false
. Default: 4
FAQs
Only pass through files once until changed
We found that gulp-once demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.