
Security News
OpenClaw Skill Marketplace Emerges as Active Malware Vector
Security researchers report widespread abuse of OpenClaw skills to deliver info-stealing malware, exposing a new supply chain risk as agent ecosystems scale.

A simple CoffeeScript build tool with coffee.config.cjs
Install Milkee:
# global installation
npm i -g milkee
# or local installation
npm i -D milkee
CoffeeScript & @babel/core are required.
[!TIP]
@babel/coreis required ifoptions.transpileistrue.
# global installation
npm i -g coffeescript @babel/core
# or local installation
npm i -D coffeescript @babel/core
Run -s (--setup) command, generate coffee.config.cjs!
# global
milkee -s
# or local
npx milkee -s
/** @type {import('@milkee/d').Config} */
module.exports = {
// The entry point for compilation.
// This can be a single file or a directory (e.g., 'src/' or 'src/app.coffee').
entry: 'src',
// The output for the compiled JavaScript files.
// If 'options.join' is true, this should be a single file path (e.g., 'dist/app.js').
// If 'options.join' is false, this should be a directory (e.g., 'dist').
output: 'dist',
// (Optional) Additional options for the CoffeeScript compiler.
// See `coffee --help` for all available options.
// Web: https://coffeescript.org/annotated-source/command.html
options: {
// The following options are supported:
// bare: false,
// join: false,
// map: false,
// inlineMap: false,
// noHeader: false,
// transpile: false,
// literate: false,
// watch: false,
},
// (Optional) Additional options/plugins for the Milkee builder.
milkee: {
options: {
// Before compiling, reset the directory.
// refresh: false,
// Before compiling, prompt "Do you want to Continue?".
// confirm: false,
// After compiling, copy non-coffee files from entry to output directory. (Only works when options.join is false)
// copy: false,
},
plugins: []
},
};
options (CoffeeScript Compiler Options)These options are passed directly to the coffee compiler.
| Option | Type | Default | Description |
|---|---|---|---|
bare | boolean | false | compile without a top-level function wrapper |
join | boolean | false | concatenate the source CoffeeScript before compiling |
map | boolean | false | generate source map and save as .js.map files |
inlineMap | boolean | false | generate source map and include it directly in output |
noHeader | boolean | false | suppress the "Generated by" header |
transpile | boolean | false | pipe generated JavaScript through Babel |
literate | boolean | false | treat stdio as literate style coffeescript |
watch | boolean | false | watch scripts for changes and rerun commands |
milkee.options (Milkee Specific Options)These options control Milkee's behavior.
| Option | Type | Default | Description |
|---|---|---|---|
refresh | boolean | false | Before compiling, reset the output directory. |
confirm | boolean | false | Before compiling, prompt "Do you want to Continue?". |
copy | boolean | false | After compiling, copy non-coffee files from entry to output directory. (Only works when options.join is false) |
milkee.plugins (Milkee Specific Plugins)You can extend Milkee's functionality by using plugins. Plugins are simple functions that run after each successful compilation, giving you access to the compiled files and configuration.
Example:
const myPlugin = require('./plugins/my-plugin.js');
module.exports = {
// ...
milkee: {
plugins: [
// This call returns the PluginExecutor
myPlugin({ option: 'value' }),
// ...
]
}
}
Milkee will automatically read coffee.config.cjs, assemble the command from your options, and start compilation!
# global
milkee
# or local
npx milkee
FAQs
A simple CoffeeScript build tool with coffee.config.cjs ☕
We found that milkee demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Security researchers report widespread abuse of OpenClaw skills to deliver info-stealing malware, exposing a new supply chain risk as agent ecosystems scale.

Security News
Claude Opus 4.6 has uncovered more than 500 open source vulnerabilities, raising new considerations for disclosure, triage, and patching at scale.

Research
/Security News
Malicious dYdX client packages were published to npm and PyPI after a maintainer compromise, enabling wallet credential theft and remote code execution.