Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
ngmin is an AngularJS application pre-minifier. The goal is ultimately to use this alongside yeoman and grunt to make developing and building Angular apps fast, easy, and fun.
Turns this
angular.module('whatever').controller('MyCtrl', function ($scope, $http) { ... });
into
angular.module('whatever').controller('MyCtrl', ['$scope', '$http', function ($scope, $http) { ... }]);
so that minifiers can handle AngularJS's DI annotations and you can save a few keystrokes.
Install via npm:
npm install -g ngmin
ngmin
is available for Rails via ngmin-rails
.
ngmin
is available for Clojure Ring via optimus-angular
as an Optimus
asset middleware.
Ideally, you should concat all of your files, then run ngmin
once on the concatenated file.
ngmin somefile.js somefile.annotate.js
From here, the annotated file(s) to a minifier.
ngmin
also accepts stdio. The following is the same as above:
ngmin < somefile.js > somefile.annotate.js
ngmin
now has a dynamic mode that you can enable with the -d
or --dynamic
flag:
ngmin -d < code.js
It runs your program in node with a patched version of Angular to try to detect places to annotate. This feature is new and might have rough edges.
See ngmin-dynamic for more.
ngmin
does not currently attempt to be fully generalized, and might not work if you're too clever. If you follow these conventions, which are the same as what the AngularJS Yeoman generator defaults, you should be fine.
// like this
angular.module('myModuleName', ['dependOnThisModule']);
// like this
angular.module('myModuleName').controller('MyCtrl', function ($scope) {
// ...
});
This should work for all injectable APIs.
// like this
angular.module('myModuleName').service('myService', function ($scope) {
// ...
});
You can methods like this, and ngmin
should still work fine:
// like this
angular.module('myModuleName').
service('myFirstService', function ($scope) {
// ...
}).
service('mySecondService', function ($scope) {
// ...
});
This works with all injectable APIs.
This is not the preferred way of dealing with modules, and thus support for it isn't completely comprehensive. Something like this will work:
var myMod = angular.module('myMod', []);
myMod.service('myService', function ($scope) {
// ...
});
But something like this will probably fail spectacularly:
var myMod = angular.module('myMod', []);
var mod1, mod2, mod3;
mod1 = myMod;
mod3 = (function () {
return mod2 = mod1;
}());
mod3.service('myService', function ($scope) {
// ...
});
Please don't write code like the second example. :)
AngularJS's DI system inspects function parameters to determine what to inject:
// angular knows to inject "myService" based on the parameter in "myFactory"
someModule.factory('myFactory', function (myService) {
// ...
});
AngularJS does this for Module#controller
, Module#service
, Module#factory
, etc. Check out the developer guide on DI for more info.
JavaScript minifiers rename function parameters. The code above, when minified, might look like this:
// the "myService" parameter has been renamed to "a" to save precious bytes
someModule.factory('myFactory', function (a) {
// ...
});
To overcome this, AngularJS has a "minifier-safe inline" notation (see Inline Annotation in the docs) that annotates angular.controller
, angular.service
, angular.factory
with an array of dependencies' names as strings:
// angular knows to inject "myService" based on the parameter in "myFactory"
someModule.factory('myFactory', ['myService', function (myService) {
// ...
}]);
So with this notation, when minified, still includes the correct dependency names even if the function arguments are re-written:
someModule.factory('myFactory', ['myService', function (a) {
// minified variable "a" will represent "myService"
// ...
}]);
Writing the "minifier-safe" version by hand is kind of annoying because you have to keep both the array of dependency names and function parameters in sync.
MIT
FAQs
AngularJS Minifier
The npm package ngmin receives a total of 4,301 weekly downloads. As such, ngmin popularity was classified as popular.
We found that ngmin demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.