Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Tsup is a zero-config TypeScript bundler that aims to provide a simple and efficient way to bundle TypeScript projects. It supports various output formats, minification, and other advanced features with minimal configuration.
Basic Bundling
This command bundles the TypeScript file located at `src/index.ts` into CommonJS and ES Module formats. Tsup automatically handles the TypeScript compilation and output generation.
tsup src/index.ts --format cjs,esm
Minification
This command bundles and minifies the TypeScript file located at `src/index.ts`. Minification reduces the file size by removing unnecessary whitespace and comments, making the output more efficient for production use.
tsup src/index.ts --minify
Watch Mode
This command enables watch mode, which automatically rebundles the TypeScript file located at `src/index.ts` whenever changes are detected. This is useful for development environments where you want to see changes in real-time.
tsup src/index.ts --watch
Custom Entry Points
This command allows you to specify multiple entry points for bundling. In this example, both `src/index.ts` and `src/worker.ts` are bundled into ES Module format. This is useful for projects with multiple entry files.
tsup src/index.ts src/worker.ts --format esm
Environment Variables
This command allows you to define environment variables that can be used within your TypeScript code. In this example, `PROCESS_ENV` is set to `production`, which can be used for conditional logic in the code.
tsup src/index.ts --define.PROCESS_ENV=production
Esbuild is an extremely fast JavaScript bundler and minifier. It is known for its speed and efficiency, making it a popular choice for large projects. Compared to tsup, esbuild offers more advanced features but may require more configuration.
Rollup is a module bundler for JavaScript that compiles small pieces of code into something larger and more complex, such as a library or application. It is highly configurable and supports a wide range of plugins. Rollup is more flexible but can be more complex to set up compared to tsup.
Webpack is a powerful and highly configurable module bundler for JavaScript applications. It supports a wide range of features and plugins, making it suitable for complex projects. However, it can be more challenging to configure and may require more boilerplate compared to tsup.
Bundle your TypeScript library with no config, powered by esbuild.
Anything that's supported by Node.js natively, namely .js
, .json
, .mjs
. And TypeScript .ts
, .tsx
. CSS support is experimental.
Install it locally in your project folder:
npm i tsup -D
# Or Yarn
yarn add tsup --dev
# Or pnpm
pnpm add tsup -D
You can also install it globally but it's not recommended.
tsup [...files]
Files are written into ./dist
.
You can bundle multiple files in one go:
tsup src/index.ts src/cli.ts
This will output dist/index.js
and dist/cli.js
.
For complete usages, please dive into the docs.
For all configuration options, please see the API docs.
Head over to the discussions to share your ideas.
MIT © EGOIST
FAQs
Bundle your TypeScript library with no config, powered by esbuild
We found that tsup demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.