
Security News
Another Round of TEA Protocol Spam Floods npm, But It’s Not a Worm
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.
rollup-plugin-node-externals
Advanced tools
Automatically declare NodeJS built-in modules and npm dependencies as 'external' in Rollup config
A Rollup plugin that automatically declares NodeJS built-in modules and npm dependencies as 'external'.
Useful when building a NodeJS or an Electron app and you don't want to bundle
npm modules with your own code but rather require() them at runtime.
Because I was getting tired of writing:
external: [
'path', 'fs', 'fs-jetpack', 'electron-settings' /* and many more */
]
in my rollup.config.js file each time I begin working on an Electron app. :)
npm install --save-dev rollup-plugin-node-externals
import externals from 'rollup-plugin-node-externals'
export default {
input: 'src/renderer/index.ts',
output: {
file: 'dist/renderer/bundle.js',
format: 'cjs'
},
plugins: [
externals({
deps: true, // include pkg.dependencies (default: true)
devDeps: true, // include pkg.devDependencies (default: true)
peerDeps: true, // include pkg.peerDependencies (default: true)
optDeps: true, // include pkg.optionalDependencies (default: true)
except: [] // exceptions (default: []) -- see below
})
],
external: [ // Rollup's `external` option has precedence -- see below
'electron'
]
}
By default, the plugin will mark Node built-in modules and all your dependencies as external.
path, fs, etc.) are always external. The list of built-ins is obtained via the builtin-modules package, by Sindre Sorhus.deps, devDeps, peerDeps and/or optDeps options to false to prevent the corresponding dependencies in your package.json file from being marked as external, therefore letting Rollup bundle them with your code, or...except option to remove certain dependencies from the list of externals. except can be a string, a regex, or an array of those, for example:externals({
deps: true, // Mark all dependencies as external...
except: [
'electron-reload', // ... except `electron-reload`
/^vuex?/ // and the VueJS family
]
})
external option is always honored, no matter what:plugins: [
externals({
deps: false // Keep all dependencies in the bundle
})
],
external: [
'electron' // But `electron` stays external
]
MIT
The rollup-plugin-peer-deps-external package is similar in that it also helps manage external dependencies. It specifically focuses on excluding peer dependencies from the bundle, which is useful for library authors who want to ensure that peer dependencies are not bundled. Unlike rollup-plugin-node-externals, it does not automatically exclude built-in Node.js modules.
rollup-plugin-auto-external is another package that automatically marks dependencies as external based on the package.json file. It is similar to rollup-plugin-node-externals in that it helps manage external dependencies, but it does not specifically target Node.js built-in modules. It is more focused on automating the process of marking dependencies as external based on the package's dependencies and peerDependencies fields.
FAQs
Automatically declare NodeJS built-in modules and npm dependencies as 'external' in Rollup/Vite config
The npm package rollup-plugin-node-externals receives a total of 290,388 weekly downloads. As such, rollup-plugin-node-externals popularity was classified as popular.
We found that rollup-plugin-node-externals demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.

Security News
PyPI adds Trusted Publishing support for GitLab Self-Managed as adoption reaches 25% of uploads

Research
/Security News
A malicious Chrome extension posing as an Ethereum wallet steals seed phrases by encoding them into Sui transactions, enabling full wallet takeover.