
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
web-ext-build
Advanced tools
WebExtBild is an extensible building framework for reading, processing, bundling, and deploying source code into software bundles. It is currently equipped to zip and sign WebExtenbsions.
This tool just underwent a complete redesign and rewrite. The design still wants to be proven, and the writing completed. At this point, the documentation isn't meant to promote use of this tool by other project, but as a point of reference for future development on the tool, and for use with my extensions.
web-ext-build is supposed to be installed as a local dependency and then used as npm scripts or via npx. E.g.:
"dependencies": {
"web-ext-build": "<version>",
},
"scripts": {
"build": "web-ext-build",
"dev": "web-ext-build watch",
"sign": "web-ext-build sign"
},
For more details on the CLI and build customization, see below.
Each invocation of the tool transforms the source code from some input medium through any number of processing steps to one or more output targets. The processing is performed by Stages along a Pipeline. The first Stage must read the source, e.g. from a file system directory or a ZIP file, consecutive stages may perform any transformations on the in-memory state, e.g. loading dependencies or combining/optimizing files, and the last Stage(s) should output the software, e.g. to the File system, a ZIP, or some upload location. While each Stage has exactly one predecessor, it may have multiple successors, thus allowing to build for multiple targets in one invocation. A stage may also pass to its successor(s) more than once, allowing for example watch mechanics.
The pipeline to run is deducted from YAML files and snippets, and the name of the pipeline specified on command line. The YAML files specify the following structure:
pipelines as a named set of pipelines, where each one is a list.
pipeline list entries may be stage names, pipeline names or lists of lists thereof.stages as a named set of stages, where each one is defined as an object of { from, options, initial, final, }:
from is a string <module-require-path>:<name-of-exported-function> describing the (optionally async and/or generator) function to run for this step.options is an object of any options the function above expects.initial: true marks an initial stage, and final: true marks a final stage.This structure may be defined across multiple files. As a basis, the web-ext-build.yaml in this repository is loaded.
Then, the the web-ext-build.yaml next to the package.json closest to the cwd gets to overwrite/extend that configuration, and include additional modules.
These modules may do the same through a web-ext-build.yaml or "config"."web-ext-build" in the package.json in the module root.
Finally, the command line specifies the name of the pipeline to run (defaulting to default), plus optionally overwrites to the options of the stages defined so far (as multiple inline { [name]: options, ... } yaml snippets).
Example CLI calls could be a simple web-ext-build without arguments, or web-ext-build zip 'beta-infer: { force: 42 }' 'write-zip: { to: . }' to output beta ZIP(s) with build number 42 to the CWD.
Given the name of the initial pipeline from the CLI, the pipeline steps that are actually will be derived like this from the named pipeline:
final stages should perform some output action.--help, --version)yield behavior, see util/:runStageFAQs
A build tool for WebExtensions
We found that web-ext-build demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.