
Research
/Security News
Fake imToken Chrome Extension Steals Seed Phrases via Phishing Redirects
Mixed-script homoglyphs and a lookalike domain mimic imToken’s import flow to capture mnemonics and private keys.
metalsmith-start
Advanced tools
Development server for metalsmith.
metalsmith.json.metalsmith.js.Run metalsmith-start or metalstart in your Metalsmith's project directory.
metalsmith-start
See --help for more options.
metalsmith-start honors the following variables:
NODE_ENVPORTIf either NODE_ENV is set to production, then development features (such as LiveReload) will be disabled by default.
This means that you can run a production setup using:
env NODE_ENV=production PORT=4000 metalsmith-start
This also means you can push your repo to Heroku with no changes and it'll work just fine.
If a file called metalsmith.js is found in the current directory, it's assumed it's a JS module that returns a Metalsmith instance.
Below is a sample metalsmith.js:
var Metalsmith = require('metalsmith')
var app = Metalsmith(__dirname)
.source('./src')
.destination('./public')
.use(...)
if (module.parent) {
module.exports = app
} else {
app.build(function (err) { if (err) throw err })
}
If superstatic.json or divshot.json is found in the current directory, it'll automatically be picked up. This allows you to, say, use clean_urls to allow pages to be served without the .html extension.
See superstatic for more information.
var Runner = require('metalsmith-start').Runner
var ms = new Metalsmith(dir)
.use(...)
.use(...)
var r = new Runner(ms)
r.start(function () {
console.log('started on ' + r.port)
})
metalsmith-start © 2015+, Rico Sta. Cruz. Released under the MIT License.
Authored and maintained by Rico Sta. Cruz with help from contributors (list).
ricostacruz.com · GitHub @rstacruz · Twitter @rstacruz
FAQs
Development server for Metalsmith.
The npm package metalsmith-start receives a total of 190 weekly downloads. As such, metalsmith-start popularity was classified as not popular.
We found that metalsmith-start demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Mixed-script homoglyphs and a lookalike domain mimic imToken’s import flow to capture mnemonics and private keys.

Security News
Latio’s 2026 report recognizes Socket as a Supply Chain Innovator and highlights our work in 0-day malware detection, SCA, and auto-patching.

Company News
Join Socket for live demos, rooftop happy hours, and one-on-one meetings during BSidesSF and RSA 2026 in San Francisco.