
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
A simple way to add site search to your static Hugo site using Lunr.js. Hugo-lunr will create an index file of any html and markdown documents in your Hugo project, only non-draft documents get added to the index.
Install the hugo-lunr utility via npm:
$ npm install hugo-lunr
By default hugo-lunr will read the content directory of your Hugo project and output the lunr index to public/lunr.json. If you are using the command line implementation you can pass an input directory -i and and output path/file -o.
The easiest way to use hugo-lunr is via npm scripts:
"scripts": {
"index": "hugo-lunr"
},
or to pass arguments for input and output:
"scripts": {
"index": "hugo-lunr -i \"content/subdir/**\" -o public/my-index.json"
},
Which can be executed from a terminal prompt
$ npm run index
var hugolunr = require('hugo-lunr');
new hugolunr().index();
or to set input/output paths
var hugolunr = require('hugo-lunr');
var h = new hugolunr();
h.setInput('content/faq/**');
h.setOutput('public/faq.json');
h.index();
Checkout this example page to see how to setup search using lunr.js on your website.
FAQs
Generate lunr.js index files for Hugo static site search
We found that hugo-lunr demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.