Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
rollup-plugin-external-assets
Advanced tools
A rollup plugin to make assets external but include them in the output.
A rollup plugin to make assets external but include them in the output.
Via npm
npm install --save-dev rollup-plugin-external-assets
Via yarn
yarn add -D rollup-plugin-external-assets
import nodeResolve from "@rollup/plugin-node-resolve";
import externalAssets from "rollup-plugin-external-assets";
export default {
input: "src/index.js",
output: {
file: "dist/index.js",
format: "es",
sourcemap: true,
},
plugins: [
nodeResolve(),
externalAssets("assets/*.png"),
],
};
function externalAssets(
include?: string | RegExp | (string | RegExp)[],
exclude?: string | RegExp | (string | RegExp)[],
options?: { resolve?: string | false | null },
);
string | RegExp | (string | RegExp)[]
A valid picomatch pattern, or array of patterns.
If include
is omitted or has zero length, all imports will be considered as assets.
Otherwise, an import path must match one or more of the include
patterns,
and must not match any of the exclude
patterns.
Note: patterns that include windows paths are normalized to be valid picomatch patterns.
import path from "path";
// Operate on images located in the ./assets directory.
externalAssets("assets/**/*.jpg");
// Operate on images located in the ./assets directory.
// and all stylesheet files.
externalAssets(["assets/**/*.{jpg,png}", /\.(css|scss)$/]);
// Operate on all assets except text files.
externalAssets("assets/**/*", "**/*.txt");
// Operate on all assets except text files.
// `__dirname` is the pattern's base dir instead of `process.cwd()`.
externalAssets(path.resolve(__dirname, "assets/**/*"), "**/*.txt");
resolve
{string | false | null}
: Optionally resolves the patterns against a directory other than process.cwd()
.
If a string
is specified, then the value will be used as the base directory.
Relative paths will be resolved against process.cwd()
first.
If false
, then the patterns will not be resolved against any directory.After cloning this repo, ensure dependencies are installed by running:
npm install
Then to build the final bundle:
npm run build
To run tests:
npm test
Note that rollup may emit warnings for unspecified options, or for some other reasons.
I made sure they are ignored with the ROLLUP_WARNINGS
environment variable in the npm test script.
If you want to see all the warnings when running tests, use this command instead:
npm run test:warn
Coverage report is located in tests/coverage
.
You might want to review it in your browser, and for example,
write tests for non-covered blocks, or remove them if they're useless.
To run tests and update snapshots, pass the -u
flag to jest through the test
(or test:warn
) npm script:
npm test -- -u
Please follow the conventional commits specification, because semantic-release is used to automate the whole package release workflow including: determining the next version number, generating the release notes and publishing the package.
FAQs
A rollup plugin to make assets external but include them in the output.
The npm package rollup-plugin-external-assets receives a total of 2,255 weekly downloads. As such, rollup-plugin-external-assets popularity was classified as popular.
We found that rollup-plugin-external-assets demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.