
Security News
OpenClaw Skill Marketplace Emerges as Active Malware Vector
Security researchers report widespread abuse of OpenClaw skills to deliver info-stealing malware, exposing a new supply chain risk as agent ecosystems scale.
systemjs-plugin-traceur
Advanced tools
Provides Traceur transpilation in the browser and in builds when using SystemJS 0.19.12+ and SystemJS Builder 0.15+.
Compatible with the the automatic Rollup optimizations in SystemJS Builder.
jspm install plugin-babel
Then set transpiler: 'plugin-babel' in the jspm.js config file.
Alternatively use jspm init -p to set up the plugin automatically.
As well as this plugin, Traceur and Traceur Runtime must be manually configured.
This plugin is available at npm install systemjs-plugin-traceur.
Traceur can be installed via npm install traceur or from GitHub at https://github.com/jmcriffey/bower-traceur and https://github.com/jmcriffey/bower-traceur-runtime.
The npm version contains traceur.js and traceur-runtime.js within the bin folder.
The plugin can be used in SystemJS with the following configuration:
SystemJS.config({
map: {
'plugin-traceur': 'path/to/systemjs-plugin-traceur/plugin-traceur.js',
'traceur': 'path/to/traceur.js',
'traceur-runtime': 'path/to/traceur-runtime.js'
},
meta: {
'traceur': {
format: 'global',
exports: 'traceur'
},
'traceur-runtime': {
format: 'global',
exports: '$traceurRuntime'
}
},
transpiler: 'plugin-traceur',
trasnpilerRuntime: false
});
It is important to set the transpilerRuntime: false option so that Traceur doesn't interfere with the deprecated internal Traceur compilation layer of SystemJS.
The metadata above is necessary otherwise Traceur will not load property in SystemJS.
The plugin can also be configured as a loader through metadata in SystemJS.
Traceur compilation options can be set via traceurOptions in SystemJS:
SystemJS.config({
traceurOptions: {
asyncFunctions: true
}
});
The full list of configuration options can be found at https://github.com/google/traceur-compiler/blob/master/src/Options.js#L25.
Build support works with no further configuration through the standard jspm build and bundle commands.
To build with SystemJS builder, use the following build configuration:
builder.config({
map: {
'systemjs-babel-build': 'path/to/systemjs-plugin-babel/systemjs-babel-node.js'
}
});
builder.bundle('app.js', 'out-bundle.js'); // create a named bundle
builder.buildStatic('app.js', 'out-static.js', { format: 'cjs' }); // create a static optimized build
When using builder.buildStatic, the ES module structure will be preserved and Rollup optimizations will included automatically
allowing for static dead code removal.
Because Traceur runtime is a global, it can't be included in the Rollup optimizations.
It can be useful to entirely separate out the traceur-runtime dependency from the build and have it in its own bundle, for example via:
builder.buildStatic('app.js - traceur-runtime', 'out-static.js', { format: 'cjs' });
This way, the entire bundle runs through Rollup for a fully-optimized output.
MIT
FAQs
SystemJS Traceur Plugin ===
The npm package systemjs-plugin-traceur receives a total of 53 weekly downloads. As such, systemjs-plugin-traceur popularity was classified as not popular.
We found that systemjs-plugin-traceur demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Security researchers report widespread abuse of OpenClaw skills to deliver info-stealing malware, exposing a new supply chain risk as agent ecosystems scale.

Security News
Claude Opus 4.6 has uncovered more than 500 open source vulnerabilities, raising new considerations for disclosure, triage, and patching at scale.

Research
/Security News
Malicious dYdX client packages were published to npm and PyPI after a maintainer compromise, enabling wallet credential theft and remote code execution.