Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
victory-tree
Advanced tools
Boilerplate for developing a Victory Component!
We expect these opinions to change often. We've written a yeoman generator to pull down the freshest copy of this repo whenever you use it. It just copies this repo so you don't have to. Check it out here
Build for production use (NPM, bower, etc).
$ npm run build
Which is composed of commands to create dist
UMD bundles (min'ed, non-min'ed)
$ npm run build-dist
and the ES5 lib
:
$ npm run build-lib
Note that dist/
files are only updated and committed on tagged releases.
All development tasks consist of watching the demo bundle, the test bundle and launching a browser pointed to the demo page.
Run the demo
application in a browser window with hot reload:
(More CPU usage, but faster, more specific updates)
$ npm run hot # hot test/app server (OR)
$ npm run open-hot # hot servers _and a browser window opens!_
Run the demo
application with watched rebuilds, but not hot reload:
$ npm run dev # dev test/app server (OR)
$ npm run open-dev # dev servers _and a browser window opens!_
From there you can see:
During development, you are expected to be running either:
$ npm run dev
$ npm run hot
to build the src and test files. With these running, you can run the faster
$ npm run check-dev
Command. It is comprised of:
$ npm run lint
$ npm run test-dev
Note that the tests here are not instrumented for code coverage and are thus more development / debugging friendly.
CI doesn't have source / test file watchers, so has to build the test files via the commands:
$ npm run check # PhantomJS only
$ npm run check-cov # (OR) PhantomJS w/ coverage
$ npm run check-ci # (OR) PhantomJS,Firefox + coverage - available on Travis.
Which is currently comprised of:
$ npm run lint # AND ...
$ npm run test # PhantomJS only
$ npm run test-cov # (OR) PhantomJS w/ coverage
$ npm run test-ci # (OR) PhantomJS,Firefox + coverage
Note that (test|check)-(cov|ci)
run code coverage and thus the
test code may be harder to debug because it is instrumented.
The client tests rely on webpack dev server to create and serve the bundle
of the app/test code at: http://127.0.0.1:3001/assets/main.js which is done
with the task npm run server-test
(part of npm dev
and npm hot
).
Code coverage reports are outputted to:
coverage/
client/
BROWSER_STRING/
lcov-report/index.html # Viewable web report.
Built files in dist/
should not be committeed during development or PRs.
Instead we only build and commit them for published, tagged releases. So
the basic workflow is:
# Update version
$ vim package.json # and bump version
$ git add package.json
# Create the `dist/*{.js,.map}` files and publish working project to NPM.
$ npm publish
# ... the project is now _published_ and available to `npm`.
# Commit, tag
$ git add dist/
$ git commit -m "Bump version to vVERS"
$ git tag -a "vVERS" -m "Version VERS"
$ git push
$ git push --tags
# ... the project is now pushed to GitHub and available to `bower`.
Side note: npm publish
runs npm prepublish
under the hood, which does the
build.
Please see CONTRIBUTING
FAQs
[![Travis Status][trav_img]][trav_site]
We found that victory-tree demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.