Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
metalsmith
Advanced tools
An extremely simple, pluggable static site generator.
In Metalsmith, all of the logic is handled by plugins. You simply chain them together.
Here's what the simplest blog looks like:
const Metalsmith = require('metalsmith')
const layouts = require('@metalsmith/layouts')
const markdown = require('@metalsmith/markdown')
Metalsmith(__dirname)
.use(markdown())
.use(layouts())
.build(function (err) {
if (err) throw err
console.log('Build finished!')
})
NPM:
npm install metalsmith
Yarn:
yarn add metalsmith
What if you want to get fancier by hiding unfinished drafts, grouping posts in collections, and using custom permalinks? Just add plugins...
const Metalsmith = require('metalsmith')
const collections = require('@metalsmith/collections')
const layouts = require('@metalsmith/layouts')
const markdown = require('@metalsmith/markdown')
const permalinks = require('@metalsmith/permalinks')
Metalsmith(__dirname)
.source('./src')
.destination('./build')
.clean(true)
.frontmatter({
excerpt: true
})
.env({
NAME: process.env.NODE_ENV,
DEBUG: '@metalsmith/*',
DEBUG_LOG: 'metalsmith.log'
})
.metadata({
sitename: 'My Static Site & Blog',
siteurl: 'https://example.com/',
description: "It's about saying »Hello« to the world.",
generatorname: 'Metalsmith',
generatorurl: 'https://metalsmith.io/'
})
.use(
collections({
posts: 'posts/*.md'
})
)
.use(markdown())
.use(
permalinks({
relative: false
})
)
.use(layouts())
.build(function (err) {
if (err) throw err
})
Metalsmith works in three simple steps:
Each plugin is invoked with the contents of the source directory, and each file can contain YAML front-matter that will be attached as metadata, so a simple file like...
---
title: A Catchy Title
date: 2021-12-01
---
An informative article.
...would be parsed into...
{
'path/to/my-file.md': {
title: 'A Catchy Title',
date: <Date >,
contents: <Buffer 7a 66 7a 67...>,
stats: {
...
}
}
}
...which any of the plugins can then manipulate however they want. Writing plugins is incredibly simple, just take a look at the example drafts plugin.
Of course they can get a lot more complicated too. That's what makes Metalsmith powerful; the plugins can do anything you want!
A Metalsmith plugin is a function that is passed the file list, the metalsmith instance, and a done callback. It is often wrapped in a plugin initializer that accepts configuration options.
Check out the official plugin registry at: https://metalsmith.io/plugins.
Find all the core plugins at: https://github.com/search?q=org%3Ametalsmith+metalsmith-plugin
See the draft plugin for a simple plugin example.
Check out the full API reference at: https://metalsmith.io/api.
In addition to a simple Javascript API, the Metalsmith CLI can read configuration from a metalsmith.json
file, so that you can build static-site generators similar to Jekyll or Hexo easily. The example blog above would be configured like this:
metalsmith.json
{
"source": "src",
"destination": "build",
"clean": true,
"metadata": {
"sitename": "My Static Site & Blog",
"siteurl": "https://example.com/",
"description": "It's about saying »Hello« to the world.",
"generatorname": "Metalsmith",
"generatorurl": "https://metalsmith.io/"
},
"plugins": [
{ "@metalsmith/drafts": true },
{ "@metalsmith/collections": { "posts": "posts/*.md" } },
{ "@metalsmith/markdown": true },
{ "@metalsmith/permalinks": "posts/:title" },
{ "@metalsmith/layouts": true }
]
}
Then run:
metalsmith
# Metalsmith · reading configuration from: /path/to/metalsmith.json
# Metalsmith · successfully built to: /path/to/build
Options recognised by metalsmith.json
are source
, destination
, concurrency
, metadata
, clean
and frontmatter
.
Checkout the static site, Jekyll examples to see the CLI in action.
If you want to use a custom plugin, but feel like it's too domain-specific to be published to the world, you can include plugins as local npm modules: (simply use a relative path from your root directory)
{
"plugins": [{ "./lib/metalsmith/plugin.js": true }]
}
We often refer to Metalsmith as a "static site generator", but it's a lot more than that. Since everything is a plugin, the core library is just an abstraction for manipulating a directory of files.
Which means you could just as easily use it to make...
Use debug to debug your build with export DEBUG=metalsmith-*,@metalsmith/*
(Linux) or set DEBUG=metalsmith-*,@metalsmith/*
for Windows.
Use the excellent metalsmith-debug-ui plugin to get a snapshot UI for every build step.
Metalsmith 2.5.x supports NodeJS versions 12 and higher.
Metalsmith 2.4.x supports NodeJS versions 8 and higher.
Metalsmith 2.3.0 and below support NodeJS versions all the way back to 0.12.
Special thanks to Ian Storm Taylor, Andrew Meyer, Dominic Barnes, Andrew Goodricke, Ismay Wolff, Kevin Van Lierde and others for their contributions!
[2.5.0] - 2022-06-10
Important note to metalsmith-watch users: Although 2.5.0 is a semver-minor release, it breaks compatibility with metalsmith-watch, which relies on the Metalsmith < 2.4.x private method signature using the outdated unyield package. See issue #374 for more details.
Metalsmith#env
method. Supports passing DEBUG
and DEBUG_LOG
amongst others. Sets CLI: true
when run from the metalsmith CLI. b42df8c
, 446c676
, 33d936b
, 4c483a3
Metalsmith#debug
method for creating plugin debuggersMetalsmith#read
,Metalsmith#readFile
,Metalsmith#write
,Metalsmith#writeFile
, Metalsmith#run
and Metalsmith#process
) to dual callback-/ promise-based methods 16a91c5
, faf6ab6
, 6cb6229
3a11a24
0a53007
README.md
0da0c4d
Metalsmith#metadata
no longer clones the object passed to it, overwriting the previous metadata, but merges it into existing metadata.metalsmith.directory()
5d75539
FAQs
An extremely simple, pluggable static site generator.
The npm package metalsmith receives a total of 24,065 weekly downloads. As such, metalsmith popularity was classified as popular.
We found that metalsmith demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.