
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Nabu is an simple, node.js powered, static site generator heavily inspired by Jekyll.
The goals of this tool are:
A website built with nabu is a result of a lot of small pieces working together. If you're new to nabu, it's hard to build a big picture view of all that's going on. Hopefully this will help!
nabu-cli is a simple tool that loads the locally installed (ie: the current folder) version of nabu. Apart from telling nabu what to do, it also gives you tools to easily create a new nabu sitenabu is the core library. It's responsible for loading files, reading the config, setting up nabu plugins into the render pipeline and providing methods that most plugins will use_config.json file. nabu runs through this list in serial, each plugin building off the work of the previous. Plugins are installed using npm. See the Plugins section for more detail_config.json ..._, like the aforementioned _config.json, are files specifically for nabu to reference or transform during site generation. For example, _posts contain markdown files consumed by the nabu-blog. You may already be familiar with this pattern from Jekyll.To use nabu, you first need the nabu-cli module globally installed:
npm install -g nabu-cli
After the cli is installed, it's time to create the foundation your site will be built on top of:
mkdir my-blog && cd my-blog
nabu init
The init command will
package.json and _config.jsonnpmFAQs
Static Site Generator
We found that nabu demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.