
Research
NPM targeted by malware campaign mimicking familiar library names
Socket uncovered npm malware campaign mimicking popular Node.js libraries and packages from other ecosystems; packages steal data and execute remote code.
html-webpack-inject-externals-plugin
Advanced tools
yarn add html-webpack-inject-externals-plugin
根据当前package.json
依赖第三方库,将需要在应用运行之前加载的所有第三方库注入到html页面中。
目前支持依据加载路径的后缀名生成标签,.css
生成link
标签,其他的都生成script标签。
const { HtmlWebpackInjectExternalsPlugin } from 'html-webpack-inject-externals-plugin'
const isProd = process.env.NODE_ENV === 'production'
...
plugins: [
new LoadExternalDependenciesWebpackPlugin({
externals: {
history: 'History',
},
host: 'http://unpkg.jd.com',
packages: [
{
name: 'history',
path: `/umd/history.${isProd ? 'min.' : ''}js`,
},
],
})
]
以上配置可生成script标签并插入document.head,如下
开发环境:
<script src="http://unpkg.jd.com/history@4.10.1/umd/history.js"></script>
或生产环境
<script src="http://unpkg.jd.com/history@4.10.1/umd/history.min.js"></script>
其中的版本号以当前项目所依赖的版本号保持一致,且会将webpack入口脚本延迟加载到该脚本加载完毕后执行。
import { LoadExternalDependenciesWebpackPlugin } from '@rmb/webpack-plugin'
import { LoadExternalDependenciesWebpackPlugin } from '@rmb/webpack-plugin/src/LoadExternalDependenciesWebpackPlugin'
plugins: [
...,
new LoadExternalDependenciesWebpackPlugin({
externals: {
history: 'History',
},
host: 'http://unpkg.jd.com',
packages: [
{
name: 'history',
path: '/umd/history.js',
},
{
name: 'animate.css',
fullPath: 'http://unpkg.jd.com/animate.css@4.1.0/animate.css',
},
],
})
]
interface OPTION {
// 参考webpack的externals的object格式配置,例如
// react: 'React'
// 'antd/lib/locale/zh_CN': ['antd', 'locales', 'zh_CN'],
// 该配置会与webpack自身的externals配置合并。
externals: {
[packageName: string]: string | string[]
}
// 载入文件域名,例如https://unpkg.com
host?: string
// 每个外部依赖的单独配置数组
packages: {
// 覆盖全局的host配置
host?: string
// 包名称
name: string
// 包内文件路径,可自行根据env添加对应的文件。例如:
// path: `/umd/react.${isProd ? 'production.min' : 'development'}.js`
// 没有加载路径时可为空
path?: string
// 该选项应为带域名路径与其他所有url参数的万丈路径模式。
// 当使用该选项时,host与path将被忽略,与当前项目package.json中依赖的版本绑定机制也将是小,该url将被直接使用作为script的src属性。
// 例如: http://cdnjs.com/react/react.min.prodjction.js
fullPath?: string
// 一些自定义属性,例如script标签的 type: 'module'
attributes?: Record<string, string>
}[]
}
FAQs
根据外部依赖配置,自动生成并插入script或link标签。
The npm package html-webpack-inject-externals-plugin receives a total of 8 weekly downloads. As such, html-webpack-inject-externals-plugin popularity was classified as not popular.
We found that html-webpack-inject-externals-plugin demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovered npm malware campaign mimicking popular Node.js libraries and packages from other ecosystems; packages steal data and execute remote code.
Research
Socket's research uncovers three dangerous Go modules that contain obfuscated disk-wiping malware, threatening complete data loss.
Research
Socket uncovers malicious packages on PyPI using Gmail's SMTP protocol for command and control (C2) to exfiltrate data and execute commands.