Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
rollup-plugin-optimize-lodash-imports
Advanced tools
Rewrites lodash imports to be specific for easier tree-shaking.
lodash
imports with Rollup.jsLike babel-plugin-lodash but runs in rollup.js without Babel. Also includes an option to use lodash-es for cases where you're outputting CommonJS and ES builds and want your ES builds to transparently use lodash-es.
import { isNil, isString } from "lodash";
import { padStart as padStartFp } from "lodash/fp";
import isNil from "lodash/isNil";
import isString from "lodash/isString";
import padStartFp from "lodash/fp/padStart";
useLodashEs
for ES Module Outputlodash-es
is not usable from CommonJS modules, but sometimes you'll use Rollup for a project with two outputs: one for ES and one for CommonJS. In this case, you can offer your users the best of both worlds:
import { isNil } from "lodash";
import isNil from "lodash/isNil";
useLodashEs: true
)import { isNil } from "lodash-es";
import optimizeLodashImports from "rollup-plugin-optimize-lodash-imports";
export default {
input: "src/index.js",
output: {
dir: "dist",
format: "cjs",
},
plugins: [optimizeLodashImports()],
};
Configuration can be passed to the plugin as an object with the following keys:
exclude
Type: String
| Array[...String]
Default: null
A minimatch pattern, or array of patterns, which specifies the files in the build the plugin should ignore. By default no files are ignored.
include
Type: String
| Array[...String]
Default: null
A minimatch pattern, or array of patterns, which specifies the files in the build the plugin should operate on. By default all files are targeted.
useLodashEs
Type: boolean
Default: false
If true
, the plugin will rewrite lodash imports to use lodash-es.
Note: the build will fail if your Rollup output format is not also set to es
!
Unlike babel-plugin-lodash, there is no support for optimizing the lodash default import, such as in this case:
// this import can't be optimized
import _ from "lodash";
export function testX(x) {
return _.isNil(x);
}
The above code will not be optimized, and Rollup will print a warning.
To avoid this, always import the specific method(s) you need:
// this import will be optimized
import { isNil } from "lodash";
export function testX(x) {
return isNil(x);
}
There are multiple issues surrounding tree-shaking of lodash.
babel-plugin-lodash
solves the issue, but it requires Babel. Many projects use @rollup/plugin-typescript which offloads transpiling to tsc
. It seems a waste to add Babel to the mix just to use babel-plugin-lodash
.
Other alternatives include eslint-plugin-lodash
with the import-scope
rule enabled. This works, but requires your time to fix all of those imports.
The lodash-es
support was inspired by tsdx
. It can be used to solve an issue where toolchains view lodash-es
and lodash
as separate packages, doubling up on the individual lodash methods shipped to browsers.
FAQs
Rewrites lodash imports to be specific for easier tree-shaking.
We found that rollup-plugin-optimize-lodash-imports demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.