Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
By Kush Pandya - Jun 06, 2025
🚀 Big News: Socket Acquires Coana to Bring Reachability Analysis to Every Appsec Team.Learn more →
vite-plugin-elm-watch
Advanced tools
vite-plugin-elm-watch
Use Vite and Elm with reliable HMR and full-color error messages
vite-plugin-elm-watch
🚨 Warning: This plugin is still experimental, and doesn't quite work as intended. Publishing here to share progress and work through minor bugs!
Use Vite and Elm with reliable HMR and full-color error messages!
Installation
npm install -D vite-plugin-elm-watch
Usage
// vite.config.js
import { defineConfig } from 'vite'
import elm from 'vite-plugin-elm-watch'
export default defineConfig({
plugins: [elm()]
})
// In src/main.js
import Main from './src/Main.elm'
let app = Main.init()
Features
- Import
*.elmfiles directly from JavaScript or TypeScript - Reliable HMR powered by elm-watch
- Full-color, friendly compiler messages in the browser
- Jump to problem from your browser in one click
- JS minification step is included
- React output mode for easy interop with existing components
Screenshots
Options
mode
When using the official Elm CLI, you have access to flags that can add Elm's time-traveling debugger, or optimize your code for production.
This plugin also adds a few additional options for minifying compiled code for production and provides nice defaults in development.
'auto' // Uses "debug" in development and "minify" in production
| 'standard' // Doesn't add any Elm compiler flags
| 'debug' // Adds the `--debug` flag
| 'optimize' // Adds the `--optimize` flag
| 'minify' // Adds the `--optimize` flag and minifies the JS output
output
'default' // Exports standard object with "init" function
| 'react' // Exports a React component that can be dropped into an existing app
This option allows you to specify what your imported Elm code will return. For React apps, we recommend using the 'react' output so you can easily swap .jsx/.tsx files with .elm and things will just work ™️.
Warning: Still working through HMR bugs before this is production ready!
isBodyPatchEnabled
isBodyPatchEnabled : boolean
In production, you might encounter issues caused by third party JS that modify the <body> element. This only is a problem for folks using Browser.application, which expects control over the entire <body> element.
By enabling isBodyPatchEnabled: true, you'll be able to specify a custom root node. This uses Elm's standard node field when initializing the app:
// src/main.js
import Main from './src/Main.elm'
let app = Main.init({
node: document.getElementById('elm_root')
})
Note: This will only work if the element has an id attribute.
A known issue is that Elm will clear out attributes for this root element, so id="elm_root" won't be visible after Elm loads.
Known issues
- When in a React app, swapping a ".elm" component with a ".tsx" will causes issues with unmounting.
- React calls
removeChildinternally on the initial DOM node, before our component can runapp.unmount(). This leads to a runtime exception!
- React calls
FAQs
Use Vite and Elm with reliable HMR and full-color error messages
The npm package vite-plugin-elm-watch receives a total of 486 weekly downloads. As such, vite-plugin-elm-watch popularity was classified as not popular.
We found that vite-plugin-elm-watch demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Package last updated on 18 Apr 2025
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Related posts
Product
Socket Now Supports pylock.toml Files
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
By Trevor Norris - Jun 05, 2025
Security News
Research
Destructive npm Packages Disguised as Utilities Enable Remote System Wipe
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.
By Kush Pandya - Jun 05, 2025