
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
rollup-plugin-bundle-html-plus
Advanced tools
This plugin is forked from ©rollup-plugin-bundle-html-plus, and is virtually the same, appart from adding more flexibility for my own needs, and adding an some useful options, like the possibilty to inline file content directly to the generated html, to exclude files, and to minify inlined css with "clean-css".
yarn add --dev rollup-plugin-bundle-html-plus
or
npm install -D rollup-plugin-bundle-html-plus
import html from 'rollup-plugin-bundle-html-plus';
export default {
input: 'src/main.js',
output: {
file: 'dist/foo/bundle.js',
},
plugins: [
html({
template: 'src/template.html',
// or html code: '<html><head></head><body></body></html>'
dest: "dist/foo",
filename: 'index.html',
inject: 'head',
exclude: [
'workers',
'externalSlowToBundleFile.js'
],
inline: true,
minifyCss: true,
externals: [
{ type: 'js', file: 'file1.js', pos: 'before' },
{ type: 'js', file: 'file2.js', pos: 'before' }
{ type: 'js', file: 'file2.js', pos: 'before', inject: 'body' },
{ type: 'css', file: 'style1.css', pos: 'before' },
{ content: '<meta name="description" content="">', pos: 'before' },
]
})
]
};
<!-- src/template.html -->
<html>
<head>
</head>
<body>
</body>
</html>
<!-- dist/foo/index.html -->
<html>
<head>
<script type="text/javascript" src="../../file1.js"></script>
<script type="text/javascript" src="../../file2.js"></script>
<script type="text/javascript" src="bundle.js"></script>
</head>
<body>
</body>
</html>
You can set string '[hash]' for output file in rollup.config.js, and your bundle and source map (if you turned on sourcemap option) will have the string '[hash]' be replaced by its hash.
export default {
input: 'src/main.js',
output: {
file: 'dist/foo/bundle-[hash].js',
// Turn on sourcemap
sourcemap: true
},
plugins: [
...
]
};
You will find both bundle and map files are hashed and placed in your dist/foo
folder:
bundle-76bf4fb5dbbd62f0fa3708aa3d8a9350.js
, bundle-84e0f899735b1e320e625c9a5c7c49a7.js.map
You can set 'onlinePath' as anything like //www.sohu.com/
if you want to put the files on CDN after building.
{
output: {
file: 'dist/foo/main.js',
},
// ...
plugins: [
html({
dest: "dist/foo",
// ...
onlinePath: '//www.sohu.com/dist/foo'
})
]
}
and you will get something like: <script src="//www.sohu.com/dist/foo/main.js"></script>
.
You can pass an option to the html()
just like above, and there are some options:
<head>
of the document.<head>
and the js
files will be inserted into <body>
.MIT
1.4.0
scriptType
are not applied to regular script tag.FAQs
create html with the bundle file
The npm package rollup-plugin-bundle-html-plus receives a total of 1 weekly downloads. As such, rollup-plugin-bundle-html-plus popularity was classified as not popular.
We found that rollup-plugin-bundle-html-plus demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.