Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
vue-sfc-rollup
Advanced tools
vue-sfc-rollup is a utility that scaffolds a minimal setup for compiling a Vue Single File Component (SFC) - or library of multiple SFCs - into a form ready to share via npm.
Install globally
# Install globally (recommended)
npm install -g vue-sfc-rollup
sfc-rollup-init
OR use via npx
# For immediate, no-install usage
npx vue-sfc-rollup
Then...
# fill in prompts
cd path/to/my-component-or-lib
# if single component
vue serve ./src/my-component.vue # Use @vue/cli or other live-refresh coding
# if library
vue serve ./src/lib-dev.vue # Use @vue/cli or other live-refresh coding
# Do dev stuff...
npm run build
# Ready to publish!
The vue-sfc-rollup utility scaffolds 4 files (6 in library mode) for you to kick of your SFC development. These files include a minimal rollup config, a corresponding package.json file with build script and dependencies, a wrapper used by rollup when packaging your SFC, and a sample SFC to kick-start development. In library mode, there is also an 'index' which declares the components exposed as part of your library, and a sample library usage file which can be used to load/test your library during development.
If you wish to integrate this into an existing SFC, please check out the vue-sfc-rollup source. The files generated by this utility are located inside the templates
directory of the repository. Merge the important bits of those file with your existing code, and you'll be good to go.
If you just want to try vue-sfc-rollup, you can run it directly via npx vue-sfc-rollup
.
For repeated use, however, you really should install it globally. To do so, simply open a terminal and execute the following:
npm install -g vue-sfc-rollup
Now, whenever you want to start a new component, you can just type sfc-rollup-init
to run the wizard, and it will scaffold a new SFC for you!
Using the vue-sfc-rollup wizard is simple. With vue-sfc-rollup installed globally, enter the following:
sfc-rollup-init
# fill in prompts
The wizard will then prompt you for the following:
After prompting you for this information, the wizard then creates copies of the files found in the templates
directory and performs some variable replacement using the information enterd.
vue-sfc-rollup is currently focused on packaging your SFC for distribution via npm. The Vue CLI is excellent for the actual development process of your SFC, and it is recommended you use the official tooling. With v3 of the Vue CLI installed globally, you can truly develop your SFC with zero configuration just by entering the following commands:
cd path/to/my-component-or-lib
# if single component
vue serve ./src/my-component.vue
# if library
vue serve ./src/lib-dev.vue
This will start up a webpack dev server with hot reloading and all the other awesomeness!
Once your development is done, it's time to package your component to publish to npm. The actual process of publishing to npm is left up to you, but the whole purpose of this project is to compile your SFC/library so that it's packaged and ready to go.
cd path/to/my-component-or-lib
npm run build
# rollup does its thing...done!
Running the build script results in 3 compiled files in the dist
directory, one for each of the main
, module
, and unpkg
properties listed in your package.json file. With these files are generated, you're ready to go!
FAQs
Quickly generate redistributable components with Rollup
The npm package vue-sfc-rollup receives a total of 147 weekly downloads. As such, vue-sfc-rollup popularity was classified as not popular.
We found that vue-sfc-rollup demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.