
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
metalsmith-layouts
Advanced tools
A metalsmith plugin for layouts
This plugin allows you to wrap your files in a template (a layout) and abstract repetitive html. The plugin will pass the contents of your files as the variable contents and renders the result with the appropriate engine. It uses the file extension of your layout to infer which templating engine to use. So layouts with names ending in .njk will be processed as nunjucks, .hbs as handlebars, etc.
If you want to process templating syntax in your files, instead of wrapping them in a template, you can use metalsmith-in-place. For support questions please use stack overflow or our slack channel. For templating engine specific questions try the aforementioned channels, as well as the documentation for jstransformers and your templating engine of choice.
Under the hood this plugin uses jstransformers to render your layouts. Since there are over a 100 jstransformers we don't install them automatically, so you'll need to install the jstransformer for the language you want to use.
For example, to render nunjucks you would install jstransformer-nunjucks, to render handlebars you would install jstransformer-handlebars, etc. The plugin will then automatically detect which jstransformers you've installed. See the jstransformer organisation for all available jstransformers and this dictionary to see which extensions map to which jstransformer.
$ npm install metalsmith-layouts
You can pass options to metalsmith-layouts with the Javascript API or CLI. The options are:
layouts.**.{}.defaultThe default layout to use. Can be overridden with the layout key in each file's YAML frontmatter, by passing either a layout or false. Passing false will skip the file entirely.
If a default layout has been specified, metalsmith-layouts will apply layouts to all files, so you might want to ignore certain files with a pattern. Don't forget to specify the default template's file extension. So this metalsmith.json:
{
"plugins": {
"metalsmith-layouts": {
"default": "default.hbs"
}
}
}
Will apply the default.hbs layout to all files, unless overridden in the frontmatter.
directoryThe directory where metalsmith-layouts looks for the layouts. By default this is layouts. So this metalsmith.json:
{
"plugins": {
"metalsmith-layouts": {
"directory": "templates"
}
}
}
Will look for layouts in the templates directory, instead of in layouts.
patternOnly files that match this pattern will be processed. So this metalsmith.json:
{
"plugins": {
"metalsmith-layouts": {
"pattern": "**/*.html"
}
}
}
Would process all files that have the .html extension. Beware that the extensions might be changed by other plugins in the build chain, preventing the pattern from matching. We use multimatch for the pattern matching.
engineOptionsUse this to pass options to the jstransformer that's rendering your templates. So this metalsmith.json:
{
"plugins": {
"metalsmith-layouts": {
"engineOptions": {
"cache": false
}
}
}
}
Would pass { "cache": false } to the used jstransformer.
suppressNoFilesErrormetalsmith-layouts throws an error in metalsmith if it can’t find any files to process. If you’re doing any kind of incremental builds via something like metalsmith-watch, this is problematic as you’re likely only rebuilding files that have changed. This flag allows you to suppress that error.
Note that if you have debugging turned on, you’ll see a message denoting when no files are present for processing.
$ npm install --save metalsmith metalsmith-layouts
In this case we'll use handlebars, so we'll install jstransformer-handlebars:
$ npm install --save jstransformer-handlebars
We'll create a metalsmith.json configuration file in the root of the project, a file in ./src that we want to render in a
layout and a handlebars layout for metalsmith-layouts to process in ./layouts:
./metalsmith.json
{
"source": "src",
"destination": "build",
"plugins": {
"metalsmith-layouts": true
}
}
./src/index.html
---
title: The title
layout: layout.hbs
---
<p>Some text here.</p>
./layouts/layout.hbs
<!DOCTYPE html>
<html>
<head>
<title>{{ title }}</title>
</head>
<body>
{{{ contents }}}
</body>
</html>
To build just run the metalsmith CLI:
$ node_modules/.bin/metalsmith
Which will output the following file:
./build/index.html
<!DOCTYPE html>
<html>
<head>
<title>The title</title>
</head>
<body>
<p>Some text here.</p>
</body>
</html>
I want to use handlebars partials and or helpers.
Use metalsmith-discover-partials and metalsmith-discover-helpers.
I want to change the extension of my templates.
Use metalsmith-rename.
My templating language requires a filename property to be set.
Use metalsmith-filenames.
If you're encountering problems you can use debug to enable verbose logging. To enable debug prefix your build command with DEBUG=metalsmith-layouts. So if you normally run metalsmith to build, use DEBUG=metalsmith-layouts metalsmith (on windows the syntax is slightly different).
There are several things that might cause you to get a no files to process error:
FAQs
A metalsmith plugin for layouts.
The npm package metalsmith-layouts receives a total of 1,728 weekly downloads. As such, metalsmith-layouts popularity was classified as popular.
We found that metalsmith-layouts demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.