
Research
/Security News
Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.
Universal Module Definition for use in automated build systems
return style module supportIn order for the UMD wrapper to work the source code for your module should return the export, e.g.
function method() {
//code
}
method.helper = function () {
//code
}
return method;
For examples, see the examples directory. The CommonJS module format is also supported by passing true as the second argument to methods.
options:
commonJS (default: false) - If commonJS is true then it will accept CommonJS source instead of source code which returns the module.The name should the the name of the module. Use a string like name, all lower case with hyphens instead of spaces.
If source should be a string, that is wrapped in umd and returned as a string.
return the text which will be inserted before a module.
return the text which will be inserted after a module.
Usage: umd <name> <source> <destination> [options]
Pipe Usage: umd <name> [options] < source > destination
Options:
-h --help Display usage information
-c --commonJS Use CommonJS module format
You can easilly pipe unix commands together like:
cat my-module.js | umd my-module | uglify-js > my-module.umd.min.js
The name passed to umd will be converted to camel case (my-library becomes myLibrary) and may only contain:
The name may not begin with a number. Invalid characters will be stripped.
MIT
FAQs
Universal Module Definition for use in automated build systems
The npm package umd receives a total of 777,043 weekly downloads. As such, umd popularity was classified as popular.
We found that umd demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.