Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
rollup-plugin-terser
Advanced tools
The rollup-plugin-terser package is a plugin for Rollup, a module bundler for JavaScript, which allows you to minify your JavaScript files using Terser. Minification is the process of removing unnecessary characters from code to reduce its size, thus improving load times in browsers. This plugin integrates Terser into the Rollup build process.
Minification
This feature allows you to minify your JavaScript files. The code sample shows how to include the terser plugin in the Rollup configuration to minify the output bundle.
import { terser } from 'rollup-plugin-terser';
export default {
input: 'src/index.js',
output: {
file: 'bundle.min.js',
format: 'iife'
},
plugins: [
terser()
]
};
Compress Options
This feature allows you to specify Terser compress options to customize the minification process. In the code sample, the `drop_console` option is set to `true` to remove console logs from the output.
import { terser } from 'rollup-plugin-terser';
export default {
// ... other rollup config
plugins: [
terser({
compress: {
drop_console: true
}
})
]
};
Mangle Options
This feature allows you to mangle property names matching a pattern to shorten the code. In the code sample, properties starting with an underscore are mangled.
import { terser } from 'rollup-plugin-terser';
export default {
// ... other rollup config
plugins: [
terser({
mangle: {
properties: {
regex: /^_/
}
}
})
]
};
Source Maps
This feature allows you to generate source maps for the minified code, which can be useful for debugging purposes. The code sample demonstrates how to enable source map generation in the Rollup configuration.
import { terser } from 'rollup-plugin-terser';
export default {
// ... other rollup config
output: {
// ... other output options
sourcemap: true
},
plugins: [
terser({
sourceMap: true
})
]
};
Similar to rollup-plugin-terser, rollup-plugin-uglify is a plugin that minifies JavaScript files using UglifyJS. It offers similar functionality but uses a different minification library. Terser is a fork of UglifyJS with ES6+ support.
This package is another Rollup plugin for minifying JavaScript, but it uses babel-minify (formerly known as babili) instead of Terser. It can be a good choice if you are already using Babel in your build process.
This plugin uses Google's Closure Compiler for minifying JavaScript. It is known for its advanced optimizations and is a good choice for projects where performance is a critical concern. However, it may be more complex to configure compared to rollup-plugin-terser.
Rollup plugin to minify generated es bundle. Uses terser under the hood.
yarn add rollup-plugin-terser --dev
Note: this package requires rollup@0.66 and higher (including rollup@1.0.0)
import { rollup } from "rollup";
import { terser } from "rollup-plugin-terser";
rollup({
input: "main.js",
plugins: [terser()]
});
⚠️ Caveat: any function used in options object cannot rely on its surrounding scope, since it is executed in an isolated context.
terser(options);
options
- terser API options
Note: some terser options are set by the plugin automatically:
module: true
is set when format
is esm
or es
toplevel: true
is set when format
is cjs
options.sourcemap: boolean
Generates source maps and passes them to rollup. Defaults to true
.
options.numWorkers: number
Amount of workers to spawn. Defaults to the number of CPUs minus 1.
options.include: Array<string | RegExp> | string | RegExp
options.exclude: Array<string | RegExp> | string | RegExp
Specifically include/exclude chunk files names (minimatch pattern, or array of minimatch patterns), By default all chunk files will be minify.
// rollup.config.js
import { terser } from "rollup-plugin-terser";
export default {
input: "index.js",
output: [
{ file: "lib.js", format: "cjs" },
{ file: "lib.min.js", format: "cjs", plugins: [terser()] },
{ file: "lib.esm.js", format: "esm" }
]
};
If you'd like that only some of the files will be minify, then you can filter by include
and exclude
to do this like so:
// rollup.config.js
import { terser } from "rollup-plugin-terser";
export default {
input: "index.js",
output: [
{ file: "lib.js", format: "cjs" },
{ file: "lib.min.js", format: "cjs" },
{ file: "lib.esm.js", format: "esm" },
{ dir: ".", entryFileNames: "lib-[format].js", format: "iife" }
],
plugins: [
terser({
include: [/^.+\.min\.js$/, "*esm*"],
exclude: ["some*"]
})
]
};
If you'd like to preserve comments (for licensing for example), then you can specify a function to do this like so:
terser({
output: {
comments: function(node, comment) {
var text = comment.value;
var type = comment.type;
if (type == "comment2") {
// multiline comment
return /@preserve|@license|@cc_on/i.test(text);
}
}
}
});
Alternatively, you can also choose to keep all comments (e.g. if a licensing header has already been prepended by a previous rollup plugin):
terser({
output: {
comments: "all"
}
});
See Terser documentation for further reference.
MIT © Bogdan Chadkin
FAQs
Rollup plugin to minify generated es bundle
We found that rollup-plugin-terser demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.