Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
rollup-plugin-external-assets
Advanced tools
A rollup plugin to make assets external but include them in the output.
A rollup plugin to make assets external,
they will not be added to the bundling pipeline,
but they will still be included in the final output.
Via npm
npm install --save-dev rollup-plugin-external-assets
Via yarn
yarn add -D rollup-plugin-external-assets
Assuming a src/index.js
exists and contains code like the following:
import logo from "../assets/logo.png";
console.log(logo);
Create a rollup.config.js
configuration file and import the plugin:
import { externalAssets } from "rollup-plugin-external-assets";
export default {
input: "src/index.js",
output: {
file: "dist/index.js",
format: "cjs",
},
plugins: [externalAssets("assets/*")],
};
Then call rollup
either via the CLI or the API.
Once the bundle is executed, you end up with a dist
directory like the following:
With dist/index.js
containing:
"use strict";
var logo = require("./assets/logo-0c6cee7b.png");
console.log(logo);
To tailor the plugin behavior to your needs, you can pass a configuration object as the argument:
include
• Type: string | RegExp | (string | RegExp)[]
A pattern, or array of patterns, to match files the plugin should operate on.
exclude
• Type: string | RegExp | (string | RegExp)[]
A pattern, or array of patterns, to match files the plugin should ignore.
resolve
• Type: string
• Default: process.cwd()
The value will be used as the base directory for resolving patterns.
After cloning this repo, ensure dependencies are installed by running:
npm install
Then to build the final bundle:
npm run build
To run tests:
npm test
To run tests with coverage report:
npm run test:coverage
Coverage report is located in tests/coverage
.
Please follow the conventional commits specification, because semantic-release is used to automate the whole package release workflow including: determining the next version number, generating the release notes and publishing the package.
FAQs
A rollup plugin to make assets external but include them in the output.
The npm package rollup-plugin-external-assets receives a total of 0 weekly downloads. As such, rollup-plugin-external-assets popularity was classified as not popular.
We found that rollup-plugin-external-assets demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.