Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
isolated-externals-plugin
Advanced tools
![Build Status](https://github.com/im-open/isolated-externals-plugin/actions/workflows/main.yml/badge.svg) [![npm version](https://badge.fury.io/js/isolated-externals-plugin.svg)](https://badge.fury.io/js/isolated-externals-plugin)
To install, simply run:
npm install --save-dev isolated-externals-plugin
The IsolatedExternalsPlugin
allows you to load external dependencies inside the scope of your webpack bundle without having to have them in your global scope. If you're curious about why you might want this, there are some use cases listed below.
It's an opinionated plugin in this way:
IsolatedExternalsPlugin
utilize externalsType.promise
, which utilizes async
/await
syntax.The plugin is built as an ES Module, so you'll need to load it in by using the default
property:
const IsolatedExternalsPlugin = require('isolated-externals-plugin').default;
An IsolatedExternalsPlugin
configuration might look like the following:
new IsolatedExternalsPlugin({
entry1: {
react: {
url: 'https://unpkg.com/react@16/umd/react.development.js',
globalName: 'React',
},
['react-dom']: {
url: 'https://unpkg.com/react-dom@16/umd/react-dom.development.js',
globalName: 'ReactDOM',
},
},
entry2: {
react: {
url: 'https://unpkg.com/react@16/umd/react.development.js',
globalName: 'React',
},
['react-dom']: {
url: 'https://unpkg.com/react-dom@16/umd/react-dom.development.js',
globalName: 'ReactDOM',
},
},
});
Each property of the configuration follows this structure:
[entryName]: {
[packageName]: {
url: [url],
globalName: [globalName]
}
}
Part | Description |
---|---|
entryName * | The name of one of your webpack Entry Points. |
packageName * | The name of the import for your externalized dependency (like 'react-dom'). |
url * | The URL from which to load your dependency file. |
globalName | The UMD name of your dependency (like ReactDOM ). See below for details |
urlTransformer | A path or module path to a module that exports a url transforming function. |
* | required |
globalName
and other detailsIf globalName
is not provided, IsolatedExternalsPlugin
will try to match the packageName
to one of your externals
entries, and will use the value from that as the globalName
The external files will be loaded and applied to your context in the order that they're listed, so if you have dependencies that depend on other dependencies (like ReactDOM
depends on React
), then you'll want to make sure you list the ones they depend on first.
IsolatedExternalsPlugin
loads the text of your externals URLs via a shared Cache (or a shared global object if Cache
is not available), and processes the text on a context object which is singular to your bundle. This allows you to load multiple bundles per page with different versions of a dependency—or with the same version of a dependency separately—without polluting a global scope, and without loading the same dependency over the wire more than once. This keeps bundle sizes down while also providing complete autonomy to any individual JS bundle.
Here are two valid use cases. There may be others, but these are the reason we built this plugin!:
This package uses semantic-release
. Changes will be compiled into a changelog and the package versioned, tagged and published automatically.
Please ensure your commit messages adhere to the following structure:
<type>: <subject>
<BLANK LINE>
<body>
Only the header is mandatory. The supported types are based off of the ESLint Convention.
FAQs
![Build Status](https://github.com/im-open/isolated-externals-plugin/actions/workflows/main.yml/badge.svg) [![npm version](https://badge.fury.io/js/isolated-externals-plugin.svg)](https://badge.fury.io/js/isolated-externals-plugin)
The npm package isolated-externals-plugin receives a total of 243 weekly downloads. As such, isolated-externals-plugin popularity was classified as not popular.
We found that isolated-externals-plugin demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.