
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
vite-plugin-jspm
Advanced tools
> Import maps: a way to control the behavior of JavaScript imports. [WICG/import-maps](https://github.com/WICG/import-maps)
Import maps: a way to control the behavior of JavaScript imports. WICG/import-maps
CDN: A content delivery network (CDN) refers to a geographically distributed group of servers which work together to provide fast delivery of Internet content. Cloudflare.com
A vite plugin which externalizes dependencies and resolves them independently from CDN (Content Delivery Network) providers using import maps and es-module-shims! This plugin generates an import map for your app automatically in both development and production, and resolves dependencies based on that.
It is based on @jspm/generator which supports different providers like jspm, unpkg and skypack.
import { defineConfig } from "vite";
import jspmPlugin from "vite-plugin-jspm";
export default defineConfig({
plugins: [jspmPlugin()],
});
inputMapinputMap is a @jspm/generator option. When passed, the plugin takes it as source of truth. And resolves the imports against it.
downloadDepsWhen passed, downloads the dependencies and bundles them with the build. But in dev mode vite dev, the plugin serves the dependencies from the CDN.
env is a @jspm/generator option. Users don't need to pass production or development option. The env is applied according to the vite env.
debug let's you skim through the logs during resolution and downloading pahses.
pollyfillProvider allow users to define their own pollyfill provider instead of ga.jspm.io, it can be a function (version: string) => string or a string. For function, the parameter version is es-module-shims's version, user should return a complete url like https://ga.jspm.io/npm:es-module-shims@1.8.0/dist/es-module-shims.js.
You can see the bundle size of test/basic example in two cases:
# with this plugin
vite v4.1.1 building for production...
✓ 16 modules transformed.
build/index.html 4.80 kB
build/assets/index-8f42e5ff.css 9.58 kB │ gzip: 1.64 kB
build/assets/index-37524fa0.js 14.11 kB │ gzip: 3.71 kB
# with downloadDeps flag in the plugin
vite v4.1.1 building for production...
✓ 45 modules transformed.
build/index.html 2.42 kB
build/assets/index-8f42e5ff.css 9.58 kB │ gzip: 1.64 kB
build/assets/index-38fd63e9.js 187.02 kB │ gzip: 59.80 kB
Feel free to open issues and PRs!
FAQs
> Import maps: a way to control the behavior of JavaScript imports. [WICG/import-maps](https://github.com/WICG/import-maps)
The npm package vite-plugin-jspm receives a total of 13,786 weekly downloads. As such, vite-plugin-jspm popularity was classified as popular.
We found that vite-plugin-jspm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.