
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
A Node-based tool for managing declarative web asset pipelines.
To install plumber, use npm to install the plumber-cli module
(globally for ease of use):
$ sudo npm install -g plumber-cli
For an introduction, you may want to read the blog post Abstracting away the grunt work with Plumber.
var all = require('plumber-all');
var glob = require('plumber-glob');
var bower = require('plumber-bower');
var requirejs = require('plumber-requirejs');
var uglifyjs = require('plumber-uglifyjs')();
var hash = require('plumber-hash')();
var concat = require('plumber-concat');
var less = require('plumber-less')();
var filter = require('plumber-filter');
var write = require('plumber-write');
module.exports = function(pipelines) {
var sources = glob.within('src');
var writeToDist = write('dist');
var requireConfig = {
paths: {
'event-emitter': '../../eventEmitter/EventEmitter'
},
shim: {
'event-emitter': {exports: 'EventEmitter'}
}
};
// Compile all JavaScript
pipelines['compile:js'] = [
all(
sources('js/require.conf.js'),
[sources('js/modules/app.js'), requirejs(requireConfig)],
bower('underscore'),
bower('pikaday', 'pikaday.js')
),
uglifyjs,
hash,
writeToDist
];
// Compile stylesheets
pipelines['compile:css'] = [
all(
sources('stylesheets/reset.css'),
[sources('stylesheets/less/*.less'), less],
[bower('pikaday'), filter.type('css')]
),
concat('style'),
writeToDist
];
};
The Plumbing.js file above defines two sample pipelines:
compile:js: Take all of the RequireJS config file, the main AMD
app.js file compiled by RequireJS, the file exported by the
underscore Bower component and the pikaday.js file in the
pikaday Bower component, minimise all the JavaScript, hash the
filenames and write the resulting JavaScript, sourcemaps and asset
mapping files in the dist directory.
compile:css: Take all of the reset.css file, the LESS files
compiled to CSS, and the CSS files exported by the pikaday
Bower component, concatenate them all into a single file named
style.css and write the result in the dist directory.
You can run each individual pipeline with plumber <pipeline> or
all of them with plumber.
Note: the syntax is still being defined and may change in the future.
Most web asset building can be described as a pipeline of operations. Each operation takes one or more files as input and returns one or more files as output. The output of an operation can be piped as input to the next operation, creating a linear pipeline. Typically, source files are fed to the pipeline and the generated files are written to a destination directory.
This model works for a variety of file types (JavaScript, CoffeeScript, LESS, Sass, etc) and a variety of operations (minimize, transpile, AMD compilation, concatenation, etc). Linting and testing can even be modeled as a pipeline, where the output is the result or report.
An operation should only be concerned about doing a single thing well, and it is asynchronous by default using RxJS. Performance optimisation such as parallelism and caching are outside the scope of operations; instead, they are the sole concern of Plumber.
File data is currently being passed as strings, rather than streams, because most libraries that operations wrap do not support streams natively anyway...
The most popular task runner. Tasks are completely independent and executed imperatively.
Both are stream-based pipelines of operations. The main difference with Plumber is the current lack of support for auxiliary files (e.g. sourcemaps) and the treatment of watch as a special listener which triggers a given block (e.g. re-run) on change.
FAQs
A tool for managing web asset pipelines
The npm package plumber receives a total of 301 weekly downloads. As such, plumber popularity was classified as not popular.
We found that plumber demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.