
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
kcd-scripts
Advanced tools
CLI toolbox for common scripts for my projects
I do a bunch of open source and want to make it easier to maintain so many projects.
This is a CLI that abstracts away all configuration for my open source projects for linting, testing, building, and more.
This module is distributed via npm which is bundled with node and
should be installed as one of your project's devDependencies
:
npm install --save-dev kcd-scripts
This is a CLI and exposes a bin called kcd-scripts
. I don't really plan on
documenting or testing it super duper well because it's really specific to my
needs. You'll find all available scripts in src/scripts
.
This project actually dogfoods itself. If you look in the package.json
, you'll
find scripts with node src {scriptName}
. This serves as an example of some of
the things you can do with kcd-scripts
.
Unlike react-scripts
, kcd-scripts
allows you to specify your own
configuration for things and have that plug directly into the way things work
with kcd-scripts
. There are various ways that it works, but basically if you
want to have your own config for something, just add the configuration and
kcd-scripts
will use that instead of it's own internal config. In addition,
kcd-scripts
exposes its configuration so you can use it and override only the
parts of the config you need to.
This can be a very helpful way to make editor integration work for tools like ESLint which require project-based ESLint configuration to be present to work.
So, if we were to do this for ESLint, you could create an .eslintrc
with the
contents of:
{"extends": "./node_modules/kcd-scripts/eslint.js"}
Note: for now, you'll have to include an
.eslintignore
in your project until this eslint issue is resolved.
Or, for babel
, a .babelrc
with:
{"presets": ["kcd-scripts/babel"]}
Or, for jest
:
const {jest: jestConfig} = require('kcd-scripts/config')
module.exports = Object.assign(jestConfig, {
// your overrides here
// for test written in Typescript, add:
transform: {
'\\.(ts|tsx)$': '<rootDir>/node_modules/ts-jest/preprocessor.js',
},
})
Note:
kcd-scripts
intentionally does not merge things for you when you start configuring things to make it less magical and more straightforward. Extending can take place on your terms. I think this is actually a great way to do this.
If the tsconfig.json
-file is present in the project root directory and
typescript
is a dependency the @babel/preset-typescript
will automatically
get loaded when you use the default babel config that comes with kcd-scripts
.
If you customized your .babelrc
-file you might need to manually add
@babel/preset-typescript
to the presets
-section.
kcd-scripts
will automatically load any .ts
and .tsx
files, including the
default entry point, so you don't have to worry about any rollup configuration.
If you have a typecheck
script (normally set to kcd-scripts typecheck
) that
will be run as part of the validate
script (which is run as part of the
pre-commit
script as well).
TypeScript definition files will also automatically be generated during the
build
script.
This is inspired by react-scripts
.
If you are aware of any please make a pull request and add it here! Again, this is a very specific-to-me solution.
esm
/cjs
/types
, ✅ in TS, ✅ yarn 3, ✅ init package.json,
✅ yarn workspace, ✅ extensible (babel, storybook, ..), 🚫 yarn pnp, 🚫 npmLooking to contribute? Look for the Good First Issue label.
Please file an issue for bugs, missing documentation, or unexpected behavior.
Please file an issue to suggest new features. Vote on feature requests by adding a 👍. This helps maintainers prioritize what to work on.
Thanks goes to these people (emoji key):
This project follows the all-contributors specification. Contributions of any kind welcome!
MIT
FAQs
CLI for common scripts for my projects
The npm package kcd-scripts receives a total of 39,735 weekly downloads. As such, kcd-scripts popularity was classified as popular.
We found that kcd-scripts demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.