Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
OneJS is a command-line utility for converting CommonJS packages to single, stand-alone JavaScript files that can be run on web browsers.
$ npm install one
OneJS walks the modules and dependencies defined by package.json files. To create your bundle, just go a project directory and type onejs build
command:
$ onejs build package.json bundle.js
The output OneJS generates can be used by NodeJS, too. It's the easiest way of making sure if the output works or not.
> var exampleProject = require('./bundle');
> exampleProject.main() // calls main module, returns its exports
> exampleProject.require('./b') // each package object has a require method available for external calls
In the case what you need is to try it in web browsers, onejs has a "server" option that'll publish the source code at localhost:1338
let you debug the output with Firebug Lite easily;
$ ../bin/onejs server example-project/package.json
Many modules of the core NodeJS library is able to be used by web projects, as well. OneJS has an 'install' command that converts demanded remote NodeJS module to a package on the fly:
> onejs install assert path url
The reference of available modules that you can install: https://github.com/azer/onejs/blob/master/lib/install_dict.js
OneJS includes a simple emulation of NodeJS' process. (Pass --noprocess if you don't need it)
> exampleProject.require('dependency'), exampleProject.require('./b');
> exampleProject.lib.process.stdout.write("Hello World");
> exampleProject.stdout();
"Hello World"
Pass --debug
parameter disabling cache and passing ENV variables to the built file. If we assume that we have a module that depends on ENV;
if( process.env.VERBOSE ){
console.log( "fabula de narratur" );
}
Above module becomes available to access ENV on debug-mode;
$ VERBOSE=1 onejs build package.json --debug
OneJS doesn't change the way we access global variables. However, we may want to use require statements to access global variables (such as document, jQuery etc..) for purposes like dependency injection or documentation. Following example demonstrates the usage of --tie
option that lets us require global variables;
var $ = require('jquery'),
dom = require('dom'),
pi = require('pi');
$(dom).ready(function(){
console.log( pi == Math.PI ); // true
});
$ onejs build package.json --tie pi=Math.PI,jquery=jQuery,dom=document
There are some cases we prefer to not have some dependency packages in the build. The --exclude
option leads OneJS ignore the specified packages;
$ onejs build package.json --exclude underscore,request
If the case is to remove a duplication from the build, it would be a good idea to combine --tie
and --exclude
together;
$ onejs build package.json --exclude underscore --tie underscore=window._
OneJS doesn't provide an embed, encapsulated console object by default. Pass --sandbox-console
if needed, output is available by projectName.stdout()
and project.stderr()
.
$ onejs build package.json foobar.js --sandbox-console
> var foobar = require('./foobar');
> foobar.stdout();
'Trying out the embed console'
'Hello world!'
> foobar.stderr()
'warning! something may be going wrong!'
'error! something went wrong!'
node_modules/
properly.onejs build package.json --verbose
projectName.map
object if it contains the missing dependencyFAQs
One is a new React Framework that makes Vite serve both native and web.
The npm package one receives a total of 1,299 weekly downloads. As such, one popularity was classified as popular.
We found that one demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.