
Research
/Security News
11 Malicious Go Packages Distribute Obfuscated Remote Payloads
Socket uncovered 11 malicious Go packages using obfuscated loaders to fetch and execute second-stage payloads via C2 domains.
vue-sfcmod
is a framework for codemodding Vue 3 Single-File Components. It aims to support <script>
codemods for both JavaScript and TypeScript with JSCodeshift, <template>
codemods with the Vue compiler and <style>
codemods with tools to be determined.
This project couldn't exist without the prior work done by vue-codemod. This repository started as a fork of vue-codemod
. The decision to fork was made because:
vue-codemod
appears to be unmaintained since 2021vue-codemod
supports both Vue 2 and Vue 3 whereas this project wants a smaller maintenance surface and only supports Vue 3vue-codemod
ships and maintains transform scripts, whereas this project aims to provide a raw codemodding framework rather than pre-built codemodsThis project also takes inspiration from vue-template-ast-to-template, a Vue 2 template stringifier. vue-sfcmod
was rewritten from scratch to target Vue 3 ASTs, however.
yarn add -D vue-sfcmod
To transform files, type the following command:
yarn vue-sfcmod <path> -t <transformation>
path
(required) - files or directory to transformtransformation
- path to a module exporting a transformation function (JS/TS only) or an object with transformation functions:
script
key for <script>
, <script setup>
and JS/TS filestemplate
for HTML <template>
style
for CSS and <style>
(not yet implemented)yarn vue-sfcmod <path>
The -t transformation
parameter is optional. If unset, vue-sfcmod
will launch an interactive prompt to let users select a preset transformation to run. To configure presets, create a configuration file as explained in the next section.
yarn vue-sfcmod <path 1> <path 2> <path 3> -t <transformation>
You may pass as many paths as you like. Each is resolved using globby.
yarn vue-sfcmod <path> -t <transformation> --custom-flag --foo=value --bar value
You may pass custom CLI parameters that will be passed to transformation functions. Three syntaxes are supported:
--custom-flag
without a value is mapped to { customFlag: true }
--foo=value
is mapped to { foo: value }
--bar value
is mapped to { bar: value }
Custom parameter names are converted to Pascal case in the object received by transformation functions. Check out the params
example for a fully working example.
vue-sfcmod --version
prints the current versionvue-sfcmod --help
prints usage documentation--custom-opt [custom value, else customOpt will be true] [...add as many custom opts as wanted]`
Any CLI option you pass apart from --version
, --help
and -t
will be passed to the script, style and template transformation functions in an object. For instance, if you pass --classes-to-add="foo bar"
, you'll receive { classesToAdd: 'foo bar' }
as a third argument to your transformation functions.
To pass configuration options to vue-sfcmod
, create a sfcmod.config.ts
file at the root of your project. Below is a sample configuration file. You can also check out the full sample file.
import type { SfcmodConfig } from 'vue-sfcmod'
const config: SfcmodConfig = {
// ...
}
export default config
This project uses cosmiconfig to read configuration files. Check the documentation for a full list of supported syntaxes and file names. TypeScript usage is recommended to get IDE autocompletion and type checking.
presets
Array of paths to preset transformation files, that are proposed to end users in an interactive prompt when they don't pass a -t
flag to the CLI.
string | { glob: string, name: (string) => string }
Each item in the array can either be a glob (resolved with globby), or an object with a glob
property and a name
property. The name
property is a function called for each file matched by the glob. It receives the path as an input, and outputs a name used in the interactive prompt.
presets: [
{
// In this example, we use folder names as a name in the CLI.
glob: './examples/**/transformation.cjs',
name: (filePath: string) =>
filePath
.replace(/\/transformation.cjs$/, '')
.split('/')
.slice(-1)[0],
},
],
To use vue-sfcmod
programmatically, you may import the runTransformation
function. It runs a transformation on a single file.
function runTransformation(
fileInfo: {
path: string
source: string
},
transformationModule: TransformationModule,
options?: { [key: string]: unknown },
): string
fileInfo
is the file to transform
fileInfo.path
is used to distinguish Vue files from JS/TS filesfileInfo.source
is the content of the filetransformationModule
is the file containing the transformation to apply (matching the signature of the -t
CLI option)options
is an arbitrary object of options passed to the transformation functions; it is optionalThe function returns a string
, containing the transformed content.
Elements using the v-text
directive and children are not supported. The Vue compiler does not compile children of elements that use the v-text
directive, so we cannot provide the content of children.
Content inside v-html
directives is printed as is and cannot be transformed.
transition
The built-in Vue transition
component is returned by the Vue compiler without HTML comment children. Because the children are missing from the compiler AST, they cannot be recovered by vue-sfcmod. Upstream issue.
When strings are passed to style
attributes, it is converted to JSON (and deduplicated in the process). This is done by the Vue compiler, and attempting to undo that conversion could result in bugs in the template codemod engine.
jscodeshift
codemods to .vue
files<script setup>
<template>
#15<template>
<style>
#16See https://github.com/facebook/jscodeshift#transform-module
No API yet. You may manually modify the AST provided by the Vue SFC compiler.
Running transformations will generally ruin the formatting of your files. A recommended way to solve that problem is by using Prettier or eslint --fix
.
FAQs
Vue 3 SFC codemod framework
The npm package vue-sfcmod receives a total of 436 weekly downloads. As such, vue-sfcmod popularity was classified as not popular.
We found that vue-sfcmod demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Socket uncovered 11 malicious Go packages using obfuscated loaders to fetch and execute second-stage payloads via C2 domains.
Security News
TC39 advances 11 JavaScript proposals, with two moving to Stage 4, bringing better math, binary APIs, and more features one step closer to the ECMAScript spec.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).