
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
imagemin-webp-webpack-plugin-next
Advanced tools
Webpack plugin which converts images to the WebP format while also keeping the original files.
Webpack plugin which converts images to the WebP format while also keeping the original files. Compatible with webpack 5, webpack 4 and previous versions as well.
It uses imagemin, imagemin-webp and imagemin-gif2webp under the hood.
Although WebP images are not currently supported in all browsers, they are at least 25% smaller than PNG's or JPEG's. So, certain users can get a much better experience. WebP also supports Gif-like functionality so this plugin also works for GIF images.
Check the support tables on Can I use
$ npm install imagemin-webp-webpack-plugin --save-dev
In order to use this plugin, add it to your webpack config.
const ImageminWebpWebpackPlugin= require("imagemin-webp-webpack-plugin");
module.exports = {
plugins: [new ImageminWebpWebpackPlugin()]
};
⚠ Keep in mind that plugin order matters, so usually you'd want to put it last.
new ImageminWebpWebpackPlugin( [settings] );Type: Object
Default:
{
config: [{
test: /\.(jpe?g|png)/,
options: {
quality: 75
}
}],
overrideExtension: true,
detailedLogs: false,
silent: false,
strict: true
}
Type Array<Object: {test, options} >
The main config of the plugin which controls how different file types are converted. Each item in the array is an object with 2 properties:
⚠ The options object is actually the same one from the imagemin-webp plugin so check their documentation for the available settings.
Type: boolean
Default: true
By default the plugin will override the original file extension, so you will get: image.png -> image.webp
In case you want to concat '.webp' at the end of the file name, set the config value to false. Ex: image.png -> image.png.webp. It may be useful when using nginx or similar to serve .webp files, if http-accept header contains webp just add a suffix to the requested image.
Type: boolean
Default: false
By default the plugin will print to the console
This options tells the plugin to also log the size difference per converted image and the names of the images that failed conversion.
Type: boolean
Default: false
In case you don't want anything printed to the console set this option to false. This will override the detailedLogs option.
Type: boolean
Default: true
By default the webpack build will fail if any of the images that match your RegExps fail the conversion.
This option tells the plugin to not crash the build and keep going :)
Recently we updated this plugin to make it compatible with webpack 5. Originally it was built for webpack 4 and earlier versions, so I expect it would be compatible no matter the project :)
However, there is a known issue with css-loader@latest where importing .webp images will fail because they don't exist prior the build time. For example this CSS code:
body {
backgrund-image: url('/assets/cover.webp')
}
will fail since initially only cover.jpg exists, and cover.webp is created dynamically by this Plugin.
Please read some more about this here and upvote the issue if you want me to implement a fix :D
webpack is smart enough to detect this and it will re-convert just that imageMade with ❤ by Pava
FAQs
Webpack plugin which converts images to the WebP format while also keeping the original files.
We found that imagemin-webp-webpack-plugin-next demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.