Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
metro-bundler-cli
Advanced tools
metro-bundler-cli
is a command line tool to bundle react native project. This project is created mainly for bundle splitting. There is another similar project rn-packger, but it uses module name as module id, which is not stable enough and not unique enough across projects. Moreover, bundles generated using rn-packager under DEV
mode are not able to run. So I made this tool to provide better bundle experience.
More stable and more unique module id
Official metro-bundler uses incremental number as module id, which has some defects when splitting bundle. You can refer to this issue [Discuss]Problems about unstable numeric module ID. for more details. rn-packger made some improvements over module id creator. It uses module name which will downgrade to a relative path included project name when no module name is provided as module id, but project name is also unstable enough, for developers may rename a repo when cloning it to local. Two different projects may also have the same name, which is likely to case module conflicts. metro-bundler-cli
uses hash of local path and module content as module id, which is more stable and more unique. Project name won't affect module id. Even two modules of two different projects have the some path, they will have different id as they have different content. By the way, stable module id is just an alternative and is not default. You must set use-stable-id
flag to be true
when you want to use stable id.
Support bundle splitting
You can split your bundle into base bundle and business bundle with 'metro-bundler-cli'. React native base bundle is stable and it's size is much bigger than business bundle usually. Splitting bundle into base bundle and business bundle is benefit of reducing business bundle downloading time and accelerating business bundle loading time.
Install with npm globally:
npm install --global metro-bundler-cli
or as a dependency for your project:
npm install --save metro-bundler-cli
metro-bundler-cli
extends the officail bundle command line tool rather than change it, so you can bundle as usual with metro-bundler-cli
.
metro-bundler bundle \
--entry-file index.js \
--bundle-output dist/business.jsbundle \
--assets-dest dist \
--platform ios \
--dev false
metro-bundler-cli
exposes three more options.
true
, use stable module id;metro-bundler bundle \
--entry-file base.js \
--bundle-output dist/base.jsbundle \
--assets-dest dist \
--manifest-output dist/base.manifest.json \
--platform ios \
--dev false
--use-stable-id true
metro-bundler bundle \
--entry-file index.js \
--bundle-output dist/business.jsbundle \
--manifest-output dist/business.manifest.json \
--assets-dest dist \
--exclude dist/base.manifest.json \
--platform ios \
--dev false
--use-stable-id true
FAQs
A command line tool of metro bundler
The npm package metro-bundler-cli receives a total of 3 weekly downloads. As such, metro-bundler-cli popularity was classified as not popular.
We found that metro-bundler-cli demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.