Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
gulp-uglify
Advanced tools
The gulp-uglify package is a Gulp plugin that minifies JavaScript files using UglifyJS. It helps in reducing the file size of JavaScript files by removing unnecessary characters, comments, and whitespace, making the code more efficient for production environments.
Basic Minification
This feature allows you to minify JavaScript files. The code sample demonstrates how to create a Gulp task that takes JavaScript files from the 'src' directory, minifies them using gulp-uglify, and outputs the minified files to the 'dist' directory.
const gulp = require('gulp');
const uglify = require('gulp-uglify');
gulp.task('minify-js', function() {
return gulp.src('src/*.js')
.pipe(uglify())
.pipe(gulp.dest('dist'));
});
Handling Errors
This feature demonstrates how to handle errors during the minification process. By using the 'gulp-plumber' package, you can prevent the Gulp process from stopping when an error occurs, allowing for smoother development workflows.
const gulp = require('gulp');
const uglify = require('gulp-uglify');
const plumber = require('gulp-plumber');
gulp.task('minify-js', function() {
return gulp.src('src/*.js')
.pipe(plumber())
.pipe(uglify())
.pipe(gulp.dest('dist'));
});
Source Maps
This feature allows you to generate source maps for the minified JavaScript files. Source maps help in debugging by mapping the minified code back to the original source code. The code sample shows how to initialize source maps, minify the JavaScript files, and write the source maps to the output directory.
const gulp = require('gulp');
const uglify = require('gulp-uglify');
const sourcemaps = require('gulp-sourcemaps');
gulp.task('minify-js', function() {
return gulp.src('src/*.js')
.pipe(sourcemaps.init())
.pipe(uglify())
.pipe(sourcemaps.write('./'))
.pipe(gulp.dest('dist'));
});
Terser is a JavaScript parser and mangler/compressor toolkit for ES6+. It is a popular alternative to UglifyJS and is known for its better support for modern JavaScript syntax. Terser can be used with Gulp through the 'gulp-terser' plugin, offering similar functionalities to gulp-uglify but with improved ES6+ support.
Babel-Minify is a minifier based on the Babel toolchain. It is designed to work seamlessly with Babel, making it a good choice for projects that already use Babel for transpiling. Babel-Minify can be integrated with Gulp using the 'gulp-babel-minify' plugin, providing an alternative to gulp-uglify with better integration for Babel users.
Uglify-ES is a fork of UglifyJS that adds support for ES6+ syntax. It is no longer actively maintained, but it was created to address the need for minifying modern JavaScript code. While gulp-uglify does not support ES6+ syntax, Uglify-ES can be used with Gulp through the 'gulp-uglify-es' plugin for projects that require ES6+ support.
Minify JavaScript with UglifyJS2.
Install package with NPM and add it to your development dependencies:
npm install --save-dev gulp-uglify
var gulp = require('gulp');
var uglify = require('gulp-uglify');
var pump = require('pump');
gulp.task('compress', function (cb) {
pump([
gulp.src('lib/*.js'),
uglify(),
gulp.dest('dist')
],
cb
);
});
To help properly handle error conditions with Node streams, this project
recommends the use of pump
. For more
information, see Why Use Pump?.
mangle
Pass false
to skip mangling names.
output
Pass an object if you wish to specify additional output options. The defaults are optimized for best compression.
compress
Pass an object to specify custom compressor
options. Pass false
to skip
compression completely.
preserveComments
A convenience option for options.output.comments
. Defaults to preserving no
comments.
all
Preserve all comments in code blocks
license
Attempts to preserve comments that likely contain licensing information,
even if the comment does not have directives such as @license
or /*!
.
Implemented via the uglify-save-license
module, this option preserves a comment if one of the following is true:
MIT
, @license
, or Copyright
.function
Specify your own comment preservation function. You will be passed the
current node and the current comment and are expected to return either
true
or false
.
some
(deprecated)
Preserve comments that start with a bang (!
) or include a Closure Compiler
directive (@preserve
, @license
, @cc_on
).
Deprecated in favor of the license
option, documented above.
You can also pass the uglify
function any of the options listed
here to modify
UglifyJS's behavior.
gulp-uglify
emits an 'error' event if it is unable to minify a specific file.
Wherever possible, the PluginError object will contain the following properties:
fileName
lineNumber
message
By default, gulp-uglify
uses the version of UglifyJS installed as a dependency.
It's possible to configure the use of a different version using the "minifier" entry point.
var uglifyjs = require('uglify-js'); // can be a git checkout
// or another module (such as `uglify-js-harmony` for ES6 support)
var minifer = require('gulp-uglify/minifier');
var pump = require('pump');
gulp.task('compress', function (cb) {
// the same options as described above
var options = {
preserveComments: 'license'
};
pump([
gulp.src('lib/*.js'),
minifier(options, uglifyjs),
gulp.dest('dist')
],
cb
);
});
FAQs
Minify files with UglifyJS.
The npm package gulp-uglify receives a total of 310,467 weekly downloads. As such, gulp-uglify popularity was classified as popular.
We found that gulp-uglify demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.