
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Webpack SSI loader
This is a very simple implementation of SSI to be used with as a webpack loader in development mode.
Currently only include directives are supported:
<!-- absolute path (webpack-config location.include is needed) -->
<!--# include virtual="/includes/new/pre/async" -->
<!-- relative path -->
<!--# include virtual="./includes/new/pre/async" -->
<!-- relative path ('@'' means root of the project) -->
<!--# include virtual="@/includes/new/pre/async" -->
Inside your webpack.dev.config.js file just add the reference to ssi-loader:
// webpack.dev.config.js
module: {
rules: [{
test: /\.html?$/,
use: [
{
loader: 'html-loader' // Used to output as html
},
{
loader: 'ssi-loader',
options: {
locations: {
"include": "https://github.com/Jogiter/ssi-loader",
}
}
}
]
}]
}
This will replace all SSI directives with the actual include content. The ssi-loader only handles the server side includes, in order to return a valid webpack source you can use the html-loader like shown in the previous example.
ssi-loader,会将 ssi 内的内容替换掉页面的注释语法 。而实际上,希望 ssi 更新后可以实时更新,在产品模式不使用ssi-loader,只在在生产模式使用。
html-webpack-plugin 最新版不支持 3.x webpack
ssi-loader bugs:
FAQs
Webpack SSI loader
The npm package ssi-loader receives a total of 8 weekly downloads. As such, ssi-loader popularity was classified as not popular.
We found that ssi-loader demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.