
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
proxy-linked-module-request
Advanced tools
proxy webpack linked module inner request to origin node_modules
使用 webpack 编译
package1 本地调试 package2 //package1 import 'package2'
yarn link package2
// package1:
// index.ts
import react from "react" // 从 package1 node_modules 获取
import { fun } from "package2" //linked package2
// package2:
// index.ts
import react from "react" // 从 package2 node_modules 获取
export { fun }
// package1 有两个版本的 react ,导致运行失败
如果 package1 在本地 link 了 package2 , 因为 link 的 package 不会对 package2 内的 node_modules link. 所以 如果 package2 import 了 node_modules 还是 从 package2 的 node_modules 获取, 不是从 package1 的 node_modules 获取,这会导致 : 对于(react ,react-router ,apollo/client ) 这种必须只能从一个 node_modules 获取 的 module 产生两个版本的代码 (从 package1 import 的 和 从 package2 import 的 ) 所以必须 都改成 从 package1 node_modules 获取 资源
const {ProxyLinkedModuleRequest} = require("proxy-linked-module-request")
const webpackConfig = {
plugins: [
// linked 的 package 的完整路径 : /dir/xx/package
new ProxyLinkedModuleRequest({linkedPackagePath}),
],
}
FAQs
proxy webpack linked module inner request to origin node_modules
The npm package proxy-linked-module-request receives a total of 0 weekly downloads. As such, proxy-linked-module-request popularity was classified as not popular.
We found that proxy-linked-module-request demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.