
Security News
/Research
Popular node-ipc npm Package Infected with Credential Stealer
Socket detected malicious node-ipc versions with obfuscated stealer/backdoor behavior in a developing npm supply chain attack.
rollup-node-externals
Advanced tools
module to automatically mark node_modules as externals for rollup
This is an unstable release
Automatically list package.json dependencies as external
npm i -D rollup-node-externals
In rollup.config.js:
var rollupNodeExternals = require('rollup-node-externals');
...
module.exports = {
// ...
external: rollupNodeExternals(),
// ...
};
Now all dependencies, peerDependencies, and optionalDependencies will be listed as external.
Rollup only will include relative imports by default, but almost always you want your package.json’s dependencies to be configured as external in your rollup config. Without this configuration, rollup will give you a warning that you’re referencing an undeclared dependency.
This library accepts an options object.
options.whitelist (=[])An array for the externals to whitelist, so they will be included in the bundle. Can accept exact strings ('module_name'), regex patterns (/^module_name/), or a function that accepts the id and returns whether it should be included (id => id.startsWith('foo')).
const rollupNodeExternals = require('rollup-node-externals');
const rollupPluginCommonjs = require('rollup-plugin-commonjs');
module.exports = {
// ...
external: rollupNodeExternals({
// this will not mark `jquery` and `lodash/*` as external
whitelist: ['jquery', /^lodash\//],
}),
plugins: [
rollupPluginCommonjs(),
],
onwarn(warning) {
// if there is an unresolved import, you forgot to list it in your package.json
if (warning.code === 'UNRESOLVED_IMPORT') throw new Error(warning.message);
console.warn(warning.message);
},
// ...
};
Using the whitelist option, this is possible. You may bundle all files with extensions that are not js/jsx/json, using this regex:
rollupNodeExternals({
// load non-javascript files with extensions, presumably via loaders
whitelist: [/\.(?!js(x?|on))[^.]*$/i],
})
Contributions and pull requests welcome. Please make sure your code is covered and passes tests.
MIT
FAQs
module to automatically mark node_modules as externals for rollup
We found that rollup-node-externals demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
Socket detected malicious node-ipc versions with obfuscated stealer/backdoor behavior in a developing npm supply chain attack.

Security News
TeamPCP and BreachForums are promoting a Shai-Hulud supply chain attack contest with a $1,000 prize for the biggest package compromise.

Security News
Packagist urges PHP projects to update Composer after a GitHub token format change exposed some GitHub Actions tokens in CI logs.