
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
metalsmith-dev-server
Advanced tools
Development server for Metalsmith websites
metalsmith-dev-server is a simple, yet powerful tool to allow you to develop sites using the Metalsmith static site tool. Featuring:
:package: Install — add this into your Metalsmith project.
npm install --save-dev github:rstacruz/metalsmith-dev-server
:pencil2: Create metalsmith.js — Your project should have a file that exports the Metalsmith project.
/*
* Example metalsmith.js:
* This builds the site when ran via `node metalsmith.js`.
* When used as `require('./metalsmith')`, it returns the
* app instance.
*/
const Metalsmith = require('metalsmith')
const app = Metalsmith(__dirname)
.source('web')
.destination('public')
if (module.parent) {
module.exports = app
} else {
app.build(err => { if (err) { console.error(err.message); process.exit(1) } })
}
:memo: Add scripts — Add this to package.json.
"scripts": {
"dev": "metalsmith-dev-server metalsmith.js --watch web"
}
// This example runs the Metalsmith app in `metalsmith.js`,
// and auto-rebuilds when files in `web/` is changed.
:red_car: Start the server — Use your new script:
npm run dev
Or to specify another port:
npm run dev -- --port 3820
metalsmith-start is a more complex solution with other features, such as production mode.
metalsmith-dev-server © 2017+, Rico Sta. Cruz. Released under the MIT License.
Authored and maintained by Rico Sta. Cruz with help from contributors (list).
ricostacruz.com · GitHub @rstacruz · Twitter @rstacruz
FAQs
Development server for Metalsmith
The npm package metalsmith-dev-server receives a total of 1 weekly downloads. As such, metalsmith-dev-server popularity was classified as not popular.
We found that metalsmith-dev-server demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.