
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Monitors changes to SCSS, JS, and JSON files, and automatically compiles, minifies, and loads them
#monmin
monmin -- made for use with ExpressJS -- monitors specified directories for changes to SCSS (SASS) and JS files, and automatically compiles and minifies them. It also monitors changes to JSON files, reloading app.js JSON objects when their hard-disk versions are modified, and saving new versions while archiving old ones when asked.
monmin detects SCSS @import dependencies and will re-compile parenting files when their children come back from school, modified. The same is done for JS files using a custom format (see below).
$ npm install --save monmin
monmin is not a middleware. It runs strictly background on the server, does not deal with requests. It only needs a variable when handling JSON data.
require('monmin')();
| Key | Description | Default |
|---|---|---|
watch_dirs | Monitored directories | ['js', 'scss'] |
ignore | Ignored dirs & files array | [] |
disable_js | Ignore .js | false |
disable_scss | Ignore .scss | false |
out_dir | Output directories (filetype-specific) | {js: 'public/js', scss: 'public/css'} |
out_suffix | Output filetypes (filetype-specific) | {js: '.min.js', scss: '.css'} |
compress | Compress and minify output files boolean | true |
source_maps | Output source maps boolean | true |
log | Output log boolean | true |
log_pre | Output log prefix | `'monmin |
error_log | Error log boolean | true |
error_pre | Error log prefix | 'monmin ERROR :' |
json | JSON index => file paths (See below) | {} |
require('monmin')({
disable_js: true // do not monitor or compile .js files
, log: false // no output log
, compress: false // do not minify or compress files
});
monmin relies on UglifyJS for Javascript compiling, however UglifyJS does not yet support canonical import 'file' functionality. Monmin allows for JS imports using the format //@import 'filepath'. The comment is necessary, otherwise an Uglify compilation error will be thrown. The .js extension is assumed and is therefore not necessary. Filepaths are relative to the importing file. Imported files are concatenated to the file's beginning, irrespective of the positioning of //@import 'file'.
//@import 'key_data'
//@import 'lib/build'
// Your code below
monmin will monitor changes to JSON files, automatically re-loading the server-side variable when changes are made to the disk .json file, and saving changes to the disk .json file (while archiving the previous version) when server-side changes are made via the .save() method.
The JSON data is kept under the .data property.
var json = require('monmin')({
json: {
users: 'json/users.json'
, camels: 'json/camels.json'
}
});
var users = json.users;
console.log(users.data); // outputs JSON object saved at json/users.json
users.data.list.push({
username: 'John'
, password: 'password123'
});
users.save(); // saves updated JSON data to disk and archives past version
var camels = json.camels;
// ...
FAQs
Monitors changes to SCSS, JS, and JSON files, and automatically compiles, minifies, and loads them
We found that monmin demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.