
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
vconsole-vue-devtool-plugin
Advanced tools
vconsole-vue-devtool-plugin 是一款vConsole插件,把Vue.js官方调试工具vue-devtools移植到移动端,可以直接在移动端查看调试Vue.js应用

npm install vconsole-vue-devtool-plugin --dev-save
在工程中入口文件 (如src/main.js)
...
import VConsole from "vconsole";
import Devtools from 'vconsole-vue-devtool-plugin'
Devtools.initPlugin(new VConsole()); // 需要在创建Vue根实例前调用
...
只在开发环境下引入
new Vue({
render: (h) => h(App),
}).$mount("#app");
// 在创建跟实例以后调用, 需要借助webpack的异步模块加载能力
if(process.env.NODE_ENV === "development"){
Promise.all([import("vconsole"), import("vconsole-vue-devtool-plugin")]).then(
(res) => {
if (res.length === 2) {
Vue.config.devtools = true;
window.__VUE_DEVTOOLS_GLOBAL_HOOK__.emit("init",Vue)
const VConsole = res[0].default;
const Devtools = res[1].default;
Devtools.initPlugin(new VConsole());
}
}
);
}
实现过程 分析完Vue、Vue-devtools、vConsole源码以后,似乎可行。步骤如下:
剥离Vue-devtools @front部分 实现@backend 和 @front 部分通信 实现front注入iframe iframe嵌入vConsole 制作npm包并发布
首先一个问题就是 Vue-devtools并不是一个库,所以npm上没有它,无法引用,其次这个工程也不适合作为库输出,因为它的打包方式比较特殊,还有这个工程本身的目的就是打包成一个可执行的App或者chrome插件,所以如果想引用它里面的代码,我想到最简单的方式就是拷贝了。。。所以剥离frontend非常简单,在Vue-devtools工程的package.json中增加script:"buildvc": "cd packages/shell-dev && cross-env NODE_ENV=production webpack \--progress \--hide-modules", 同时在shell-dev里增加一个文件叫 inject.js
import { initDevTools } from '@front'
import Bridge from '@utils/bridge'
const targetWindow = window.parent;
document.body.style.overflow = "scroll";
initDevTools({
connect (cb) {
cb(new Bridge({
listen (fn) {
window.addEventListener('message', evt => {
fn(evt.data)
})
},
send (data) {
targetWindow.postMessage(data, '*')
}
}))
},
onReload (reloadFn) {
reloadFn.call();
}
})
当然shell-dev里的webpack.config.js里 增加一个入口配置 inject: './src/inject.js'
打出来的包就是我们要的front部分,最终嵌入iframe里。
上面的inject.js中已经包含了 front部分 接收和发送消息的代码了。接下来完成backend部分的消息发送和接收,
import { initBackend } from '@back'
import Bridge from '@utils/bridge'
const initBackendWithTargetWindow = function(win,targetWindow){
const bridge = new Bridge({
listen (fn) {
win.addEventListener('message', evt => {
fn(evt.data)})
},
send (data) {
targetWindow.postMessage(data, '*')
}
})
initBackend(bridge)
}
export default { initBackendWithTargetWindow }
这个比较麻烦,也遇到了一些兼容性问题,最终方案是:
import injectString from './inject.txt'
function inject (scriptContent, done) {
const script = document.getElementById('vue-iframe').contentWindow.document.createElement('script')
script.text = scriptContent
document.getElementById('vue-iframe').contentWindow.document.body.appendChild(script)
}
inject(injectString)
实现一个plugin类,继承VConsolePlugin,然后实现对应的方法即可,具体文档可以查看VConsole文档vConsole Readme
class VConsoleVueTab extends VConsolePlugin {
constructor(...args) {
super(...args);
}
onRenderTab(cb){
cb(`<iframe id="vue-iframe" style="width:100%;position:absolute;top:0;bottom:0;min-height:100%;"></iframe>`);
}
onReady() {
target = document.getElementById('vue-iframe')
targetWindow = target.contentWindow;
be.initBackendWithTargetWindow(window,targetWindow);
}
onShow() {
injectOnce(injectString)
}
}
这一步需要打包发布,并且优化
const initPlugin = function(vConsole){
var tab = new VConsoleVueTab('vue', 'Vue');
vConsole.addPlugin(tab);
}
export default {
initPlugin
}
FAQs
vConsole vue-devtools plugin. Debug vue anywhere
We found that vconsole-vue-devtool-plugin demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.