
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

$ npm install smurf -g
before we run the commands of smurf, we should have a project first
(directory structure)
project
├─┬src
│ └──...
└─.config
{
"job": "job", // String job name,
"require": {
"src": "path of requirejs.js", //required, relative path of requirejs.js
"mustache": "path of hogan.js", //require by using template
"paths": {
"lib": "common/lib" //alias
}
},
"registry": "http://registry.npm.fe.eucita.com", //private npm registry
//it will downloads all dependencies by using "smurf install" command
"exports":[ //exports files
"index/index", // index/index@ver.js & index/index@ver.css
"test/test.js" // test/test@ver.js
"test/cssonly.css" // test/cssonly@ver.css
// required test/cssonly.js file
],
"html": [],
"dependencies": {
"app": "*",
"jquery": "1.7.x",
"hogan": "*",
"requirejs": "*",
"icons": "*",
"button": "*",
"jquery-api": "*",
"dialog": "*",
"switcher": "*",
"filter-select": "*",
"filter-select-date": "*"
},
"dev": { //for rsync to server
"host": "127.0.0.1",
"path": "/home/q/www/project/"
}
}
$ smurf install
before start server, make sure the working directory contains project
$ sudo smurf server
server has three modes, [SRC|DEV|PRD]
$ sudo smurf server -m DEV
packing exports files
before run pack, make sure the project is working directory
$ smurf pack
result
project
├─┬dev(package directory)
│ ├─┬index
│ │ ├──index@dev.js
│ │ └──index@dev.css
│ └─┬test
│ ├──test@dev.js
│ └──cssonly@dev.css
│
├─┬src
│ ├─┬index
│ │ └──index.js
│ └─┬test
│ ├──test.js
│ └──cssonly.js
└─.config
minify exports files
before run min, make sure the project is working directory
$ smurf min
result
├─┬dev(package directory)
│ ├─┬index
│ │ ├──index@bc23723a6ebdd528a774264d37173293.js
│ │ └──index@db47495f5329bd6a6df53228034d4746.css
│ └─┬test
│ ├──test@dev.js
│ └──cssonly@dev.css
│
├─┬src
│ ├─┬index
│ │ └──index.js
│ └─┬test
│ ├──test.js
│ └──cssonly.js
└─.config
project
├─┬prd(product directory)
│ ├─┬index
│ │ ├──index@bc23723a6ebdd528a774264d37173293.js
│ │ └──index@db47495f5329bd6a6df53228034d4746.css
│ └─┬test
│ ├──test@version1.js
│ └──cssonly@version2.css
│
├─┬ver(versions directory)
│ ├─┬index
│ │ ├──index.js.ver (bc23723a6ebdd528a774264d37173293)
│ │ └──index.css.ver (db47495f5329bd6a6df53228034d4746)
│ └─┬test
│ ├──test.js.ver (version1)
│ └──cssonly.css.ver (version2)
│
├─┬src
│ ├─┬index
│ │ └──index.js
│ └─┬test
│ ├──test.js
│ └──cssonly.js
└─.config
sync all package to target server
make sure you installed rsync (find it here http://rsync.samba.org/)
set dev environment in .config
before run sync
$ smurf sync
we also run pack and sync together
$ smurf pack && smurf sync
{
"job": "vs",
"require": {
"src": "node_modules/requirejs/index.js",
"mustache": "node_modules/hogan/index.js",
"prd": "node_modules/release/index.js",
"paths": {
"modules":"modules"
}
},
"html": [{
"name": "index.jsp",
"title": "Viewscope",
"domain": "static.eucita.com",
"body": "index/index.mustache",
"js": "index/index.js",
"css": "index/index.css"
},{
"name": "manage.jsp",
"title": "Viewscope Manage",
"domain": "static.eucita.com",
"body": "manage/index.mustache",
"js": "manage/index.js",
"css": "manage/index.css"
}],
"exports":[
"index/index",
"manage/index"
],
"dependencies": {
"app": "*",
"jquery": "1.7.x",
"hogan": "*",
"release": "*",
"requirejs": "*",
"icons": "*",
"button": "*",
"jquery-api": "*",
"dialog": "*",
"switcher": "*",
"filter-select": "*",
"filter-select-date": "*"
},
"registry": "http://registry.npm.fe.eucita.com"
}
FAQs
Fe development tool
The npm package smurf receives a total of 26 weekly downloads. As such, smurf popularity was classified as not popular.
We found that smurf demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.