
Research
Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.
laravel-mix-imgmin
Advanced tools
Laravel Mix extension to compress images [png,jpg,jpeg,svg,gif,bmp,ico] with TinyPNG.
Laravel Mix extension to compress images [png,jpg,jpeg,svg,gif,bmp,ico] with TinyPNG.
This extension uses Gulp 4. This can create unexpected behavior if you are using older version of Gulp inside your project.
Install the extension:
npm install laravel-mix-imgmin
Or if you prefer yarn:
yarn add laravel-mix-imgmin
Next require the extension inside your Laravel Mix config and call imgmin() in your pipeline:
// webpack.mix.js
const mix = require('laravel-mix');
require('laravel-mix-imgmin');
mix.js('resources/js/app.js', 'public/js')
.sass('resources/sass/app.scss', 'public/css')
.imgmin();
If nothing is passed to the extension inside your Laravel Mix config, the following options will be used:
{
input: 'resources/img',
publicPath: 'public',
output: 'img',
tinyPngKey: null,
debug: false
}
input (string). Your input directory where images are located.publicPath (string). Your application's public path.output (string). Your output directory where compressed images will be saved.tinyPngKey (string or null). Your TinyPNG key. If you don't provide TinyPNG key, then default gulp-imagemin package will be used. TinyPNG is recommended for the best results.debug (boolean). Whenever to log extension events messages to the console.laravel-mix version 6FAQs
Laravel Mix extension to compress images [png,jpg,jpeg,svg,gif,bmp,ico] with TinyPNG.
We found that laravel-mix-imgmin demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.

Product
Explore exportable charts for vulnerabilities, dependencies, and usage with Reports, Socket’s new extensible reporting framework.

Product
Socket for Jira lets teams turn alerts into Jira tickets with manual creation, automated ticketing rules, and two-way sync.