
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
unplugin-build-version-info
Advanced tools
这是一个为 Webpack 和 Vite 构建工具提供统一解决方案的插件,用于在构建产物中生成包含版本信息的 version.json 文件。
version.json 文件中。unplugin 库来实现跨构建工具(Webpack, Vite, Rollup)的兼容性。tsup 进行项目自身的构建,生成 CommonJS (cjs) 和 ES Module (esm) 格式的产物。child_process 模块执行 Git 命令获取版本信息。src/index.js: 插件的主入口。
createUnplugin 定义插件。webpack 和 vite/rollup 定义了特定的钩子(hooks),确保在不同的构建环境下都能正确生成 version.json。src/core.js: 核心逻辑文件。
getBuildInfo 函数,通过 git 命令获取当前代码仓库的状态(分支、Commit ID、时间等)。formatDate 辅助函数用于格式化时间。package.json:
build 脚本:tsup src/index.js --format cjs,esm --dts --clean,用于打包插件并生成类型定义文件。npm install unplugin-build-version-info --save-dev
# or
yarn add unplugin-build-version-info -D
# or
pnpm add unplugin-build-version-info -D
在 vite.config.ts 或 vite.config.js 中配置:
import { defineConfig } from "vite";
import { BuildInfoPlugin } from "unplugin-build-version-info";
export default defineConfig({
plugins: [BuildInfoPlugin.vite()],
});
在 webpack.config.js 中配置:
const { BuildInfoPlugin } = require("unplugin-build-version-info");
module.exports = {
// ...
plugins: [BuildInfoPlugin.webpack()],
};
插件运行后,会在构建输出目录生成类似如下内容的 version.json 文件:
{
"branch": "main",
"commit": "a1b2c3d4...",
"commitTime": "2023-10-27 10:00:00",
"commitMessage": "feat: add new feature",
"buildTime": "2023-10-27 10:05:00"
}
FAQs
A webpack/vite plugin to generate build version info
We found that unplugin-build-version-info demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.