Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Build your libraries with ease
Rollup-based build tool for building libraries based on package.json config and simple CLI options.
It is a simple building tool that supports building to different targets like es
, cjs
, umd
without additional transformation other than minification using terser
or preprocess using rollup-plugin-preprocess
.
It is created to easily build libraries that contain multiple subpath exports (entry points, sub-packages) because it is not that easy to do at the moment with microbundle
, tsdx
or ng-packagr
(if you are on Typescript).
Using npm:
npm install --save-dev pkgbld
npm init
npm install --save-dev pkgbld
src/index.ts
"scripts": {
"build": "pkgbld"
},
Run npm run build
.
pkgbld
expects the name field to be filled in the package.json file. exports
field defines what entries/outputs should be built for this package.
pkgbld --umd=index,core
Where index,core
should be replaced by entry points that should be compiled in umd format, index
is the top level '.'
entry point.
If package.json
defines the umd
field option will default to `index``.
pkgbld --compress=es,umd
Where es,umd
should be replaced by formats that should be compressed using terser.
pkgbld --sourcemaps=es,cjs
Where es,cjs
should be replaced by targets for which source maps should be generated. Default umd
.
Supported targets for this option: es
, cjs
and umd
.
pkgbld --formats=es
Defines what formats to build, only supports es
and cjs
at the moment. Use umd
flag to build umd target.
pkgbld --preprocess=index
Defines what entry points/files should be preprocessed using rollup-plugin-preprocess
. The entry point will be defined as variable es (for esm target), cjs (for commonjs) and umd (for umd) depending on the target type. Please request more variables / more granular logic if you want more.
pkgbld --dir=dist
Directory to put output files.
pkgbld --sourcedir=src
Directory to search for input files.
pkgbld --bin=./dist/index.cjs,./dist/index.mjs
File(s) to make executable. The first entry will be added to package.json
pkgbld --include-externals
Bundles all externals into a package.
pkgbld --eject
Ejects Rollup config.
Do not check/write tsconfig.json.
pkgbld --no-update-package-json
Do not write package.json.
pkgbld
reads all installed packages named pkgbld-plugin-*
and assumes they are plugins
Plugins suppose to implement one or more of the following interface methods as their package exports:
interface PkgbldPlugin {
options(parsedArgs: {[key: string]: string | number}, options: ReturnType<typeof getCliOptions>): void;
processPackageJson(packageJson: PackageJson, inputs: string[], logger: Logger): void;
processTsConfig(config: Json): void;
providePlugins(provider: Provider, config: Record<string, string | string[] | boolean>, inputs: string[]): Promise<void>;
getExtraOutputSettings(format: InternalModuleFormat, inputs: string[]): Partial<OutputOptions>;
buildEnd(): Promise<void>;
}
FAQs
README.md
The npm package pkgbld receives a total of 174 weekly downloads. As such, pkgbld popularity was classified as not popular.
We found that pkgbld demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.