Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Rollup based build tool for building libraries based on package.json config and simple CLI options.
Rollup based build tool for building libraries based on package.json config and simple CLI options.
It is simple building tool that supports building to different targets like: es
, cjs
, umd
without additional trasformation other than minification using terser
or preprocess using rollup-plugin-preprocess
.
It is created to easily build libraries that contains mutliple subpackages (exports, entry points) because it is not that easy to do at the moment with microbundle
, tsdx
or ng-packagr
.
Using npm:
npm install --save-dev pkgbld
pkgbld
expects name field to be filled in package.json file. exports
field defined what entries/outputs should be build for this package.
pkgbld --umd=index,core
Where index,core
should be replaced by entry points that should be comiled in umd format, index is top level '.'
entry point.
If package.json
defined umd field option will be defaulted to index
.
pkgbld --compress=es,umd
Where es,umd
should be replaced by formats that should be compressed using terser.
pkgbld --sourcemaps=es,cjs
Where es,cjs
should be replaced by targets for which sourcemaps should be generated. Default umd
.
Supported targets for this option: es
, cjs
and umd
.
pkgbld --formats=es
Defines what formats to build, only supports es
and cjs
at the moment. Use umd
flag to build umd target.
pkgbld --preprocess=index
Defines what entry points/files should be preprocessed using rollup-plugin-preprocess
. For the entry point will be defined variable esm (for esm target) or cjs (for others) depending on the target type. Please request more variables / more granular logic if you want more.
pkgbld --dir=dist
Directory to put output files.
FAQs
README.md
The npm package pkgbld receives a total of 174 weekly downloads. As such, pkgbld popularity was classified as not popular.
We found that pkgbld demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.