Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
rollup-plugin-conditional-exec
Advanced tools
Execute a given command after a bundle has been written
⚙️🚀 Execute commands after writing a bundle with optionally provided conditions
This package facilitates executing a given command after a bundle has been written by Rollup. The timing of the execution of the given command can be leveraged by providing a condition to satisfy before performing the command.
For example, if you are a Vite user and you generate bundled code for es
& umd
, you can write a condition function in your vite.config.ts
that will only return true once both values have been observed, as Vite will run rollup twice to generate both of these.
I built this primarily so that after each successful bundle had been generated, yalc push
would be called.
Create a rollup.config.js
configuration file and import this plugin:
import conditionalExec from "rollup-plugin-conditional-exec";
export default {
input: "src/index.js",
output: {
file: "dist/index.js",
format: "cjs",
},
plugins: [
conditionalExec({
command: "yalc push",
}),
],
};
Typings for the options are available by importing RollupConditionalExecOptions
.
command
Type: string
Required: true
This is the command you want to be executed after a bundle has been written.
options
Type: object
Default: { stdio: "inherit" }
See CommonExecOptions
for available options.
If an options object is provided, it will override the default.
condition
Type: () => Promise<boolean> | boolean
| (outputOpts: OutputOptions) => Promise<boolean> | boolean
Default: () => true
Provide an optional condition to satisfy before a given command is executed. The condition command is passed in the OutputOptions
that are give to writeBundle
to allow you to leverage build time specific options. i.e. which bundle you are currently generating in a series of bundling operations.
afterExec
Type: () => Promise<void> | void
Default: () => undefined
Provide an optional function to be executed after the command has been executed successfully. This can allow you to tidy up state, where you need to reset a state between bundles when running in a build watch mode or similar.
onError
Type: (error: Error) => Promise<void> | void
Default:
(error: Error) => {
console.error(`Exec has failed: ${error.message}`);
console.debug(error.stack);
throw error;
};
Provide an optional function to be executed should your provided command fail to execute successfully. By default, this will log your error and then rethrow the error to prevent a silent failure.
buildStart
writeBundle
exec
function.┌──────────────── Rollup ────────────────┐
│ │
│ │
│ ┌──────────────┐ │
│ │ buildStart │ │
│ └───────┬──────┘ │
│ │ │
│ │ │
│ ▼ │
│ ┌──────────────┐ │
│ │ Assert cmd │ │
│ │ ├─── false ──┐ │
│ │ is defined │ │ │
│ └───────┬──────┘ │ │
│ │ │ │
│ │ │ │
│ true │ │
│ │ ▼ │
│ ▼ ┌─────────┐ │
│ ┌───────────────┐ │ Fail │ │
│ │ writeBundle │ │ │ │
│ └───────┬───────┘ │ Build │ │
│ │ └─────────┘ │
│ │ ▲ │
│ ▼ │ │
│ ┌───────────┐ │ │
│ │ execute │ │ │
│ │ ├──── error ──┘ │
│ │ command │ │
│ └─────┬─────┘ │
│ │ │
│ │ │
│ success │
│ │ │
│ │ │
│ ▼ │
│ ┌─────────────┐ │
│ │ Completed │ │
│ └─────────────┘ │
│ │
│ │
└────────────────────────────────────────┘
FAQs
Execute a given command after a bundle has been written
The npm package rollup-plugin-conditional-exec receives a total of 56 weekly downloads. As such, rollup-plugin-conditional-exec popularity was classified as not popular.
We found that rollup-plugin-conditional-exec demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.