Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
serviceworker-webpack-plugin
Advanced tools
Simplifies creation of a service worker to serve your webpack bundles
Simplifies creation of a service worker to serve your webpack bundles.
npm install serviceworker-webpack-plugin
When building a service worker, you probably want to cache all
your assets during the install
phase.
But in order to do so, you need their names.
That's not simple when you are using Webpack:
import ServiceWorkerWebpackPlugin from 'serviceworker-webpack-plugin';
...
plugins: [
new ServiceWorkerWebpackPlugin({
entry: path.join(__dirname, 'src/sw.js'),
}),
],
import runtime from 'serviceworker-webpack-plugin/lib/runtime';
if ('serviceWorker' in navigator) {
const registration = runtime.register();
}
sw.js
You can now use the global serviceWorkerOption
variable in your sw.js
.
E.g. In our example this object looks like:
{
assets: [
'./main.256334452761ef349e91.js',
],
}
You can have a look at the /docs
folder if you need a full working example.
ServiceWorkerWebpackPlugin(options)
options
entry
, required, string:
Path to the actual service worker implementation.filename
, string, default 'sw.js'
:
Relative (from the webpack's config output.path
) output path for emitted script.excludes
, array, default ['**/.*', '**/*.map']
:
Exclude matched assets from being added to the serviceWorkerOption.assets
variable. (Blacklist)includes
, array, default ['**/*']
:
Include matched assets added to the serviceWorkerOption.assets
variable. (Whitelist)publicPath
, string, default '/'
:
Specifies the public URL address of the output files when referenced in a browser.
We use this value to load the service worker over the network.template
, function, default noop:
This callback function can be used to inject statically generated service worker.
It's taking a serviceWorkerOption
argument and must return a promise.transformOptions
, function:
This callback function receives a raw serviceWorkerOption
argument.
The jsonStats
key contains all the webpack build information.minimize
:
Whether to minimize output. Defaults to process.env.NODE_ENV === 'production'
runtime(options)
options
: That's forwarded to the options
argument of the
ServiceWorkerContainer.register()
function.offline-plugin
?I wouldn't have been able to write this plugin without the offline-plugin project. Thanks @NekR for sharing it!
Still, soon after using it, I realized that it wasn't what I was looking for.
Hence, I decided to change the approach and created this thin layer on top of Webpack to solve the assets name issue. Nothing more.
If you don't care about my two issues with offline-plugin
then you don't need to use this package, offline-plugin
is great.
MIT
FAQs
Simplifies creation of a service worker to serve your webpack bundles
The npm package serviceworker-webpack-plugin receives a total of 7,984 weekly downloads. As such, serviceworker-webpack-plugin popularity was classified as popular.
We found that serviceworker-webpack-plugin demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.