
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
koa-web-kit
Advanced tools
🚀A Modern, Production-Ready, and Full-Stack Node Web Framework
Release Notes An Introduction for koa-web-kit
Get the latest version, and go to your project root, Also available on npm.
Before start, copy the
config/app-config.js.sampletoapp-config.js(to project root orconfigdir) for local dev configuration
npm install
npm run dev to start koa with HMR enabled, or
npm run dev:ssr to start dev server with SSR enabled(yet HMR will be disabled for now)
http://localhost:3000 to view the default react page__tests__ dir, for your testsmocks dir, for your mock json server and other mock dataapi dir, the API Proxy utility, also put your api urls in api-config.js for universal import across your appconfig dir, all webpack build configs are put here, besides, some application-wide env configs getter utilitiesservices dir, some middleware here, default logger utility also located hereroutes dir, put your koa app routes heresrc dir, all your front-end assets, react components, modules, etc...utils dir, utilities for both node.js and front-endviews dir, your view templates(NOTE: when SSR is enabled, it will use the template literal string)build dir, all built assets for your project, git ignoredlogs dir, logs are put here by default, git ignoredEvery project has some configuration or environment variables to make it run differently in different environments, for koa-web-kit, it also provides different ways to configure your ENVs.
The pre bundled file config/app-config.js.sample lists some common variables to use in the project, you should copy and rename it to app-config.js for your local config, both put it in ${project_root} or the same config dir are supported:
module.exports = {
//http server listen port
"PORT": 3000,
//most commonly used env
"NODE_ENV": "development",
//enable/disable built-in API Proxy
"NODE_PROXY": true,
//config the api proxy debug level, [0, 1, 2], 0 -> nothing, default: 1 -> simple, 2 -> verbose
"PROXY_DEBUG_LEVEL": 1,
//static endpoint, e.g CDN for your static assets
"STATIC_ENDPOINT": "",
//add a alternative prefix for your "STATIC_ENDPOINT"
"STATIC_PREFIX": "",
//add "/" to the end of your static url, if not existed
"PREFIX_TRAILING_SLASH": true,
//global prefix for your routes, e.g http://a.com/prefix/...your app routes,
//like a github project site
"APP_PREFIX": "",
//if true, the "/prefix" below will be stripped, otherwise, the full pathname will be used for proxy
"CUSTOM_API_PREFIX": true,
//if enable HMR in dev mode, `npm run dev` will automatically enable this
"ENABLE_HMR": true,
//if need to enable Server Side Rendering, `npm run dev:ssr` will automatically enable this, HMR need to be disabled for now
"ENABLE_SSR": false,
//enable CSS Modules, should disable this when SSR is enabled for now
"CSS_MODULES": false,
//API Proxies for multiple api endpoints with different prefix in router
"API_ENDPOINTS": {
//set a default prefix
"defaultPrefix": "/prefix",
//e.g http://127.0.0.1:3000/prefix/api/login -->proxy to--> http://127.0.0.1:3001/api/login
"/prefix": "http://127.0.0.1:3001",
"/prefix2": "http://127.0.0.1:3002",
}
}
All the variables in app-config.js can be set with Environment Variables(except for API_ENDPOINTS for now, since it has nested json structure), which have higher priority than app-config.js.
e.g:
> NODE_ENV=production npm start
or
export PORT=3001
export NODE_ENV=production
npm start
BTW you can do Everything you can within cli to set your env.
config.default.[dev|prod].js in config dirThe project comes with default config files just like app-config.js.sample, which will be used if app-config.js above is not provided.
Priority: Environment Variables > app-config.js > config.default.[dev|prod].js
The builtin services/logger.js provides some default log functionality for your app.
By default, the manual log(calling like logger.info()) will be put into ./logs/app.log file,
and the http requests will be put into ./logs/requests.log,
both will also be logged to console.
For more options, checkout the pino.
//use the default logger
const { logger, Logger } = require('../services/logger');
logger.info('message');
logger.error(new Error('test error'));
//create custom logger, log into a different file
const pino = require('pino');
//the 2nd params for the constructor is for only for pino options
const mylogger = new Logger({destination: pino.destination('./logs/my-log.log')}, {});
mylogger.info('my log message');
Deploy your app to production is extremely simple with only one npm script command, you can provide couple of options for different deployment phases(e.g: install, build, start server), pm2 inside is used as node process manager.
Global installation of PM2 is not required now, we will use the locally installed pm2, but if you want to use
pm2cmd everywhere, you may still want to install it globally
npm run deploy -- [skipInstall] [skipBuild] [skipServer]
The last three options are boolean values in 0(or empty, false) and 1(true).
npm run deploy: no options provided, defaults to do all the tasks.npm run deploy -- 1: same as npm run deploy:noinstall as an alias, this will skip the npm install --no-shrinkwrap, and just go to build and start server.npm run deploy -- 1 0 1: which will only build your assetsnpm run deploy -- 1 1 0: which will just start node server, useful when all assets were built on a different machine.You may need to create/update the
deploy.shto meet your own needs.
MIT @ 2016-present jason
FAQs
A modern, production-ready, and full-stack node web framework
The npm package koa-web-kit receives a total of 40 weekly downloads. As such, koa-web-kit popularity was classified as not popular.
We found that koa-web-kit demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.

Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.

Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.