
Research
/Security News
Popular Go Decimal Library Targeted by Long-Running Typosquat with DNS Backdoor
A long-running Go typosquat impersonated the popular shopspring/decimal library and used DNS TXT records to execute commands.
web-scripts-ivan
Advanced tools
环境变量,使用config-ivan库通过.env类的配置文件注入NodeJS process中.
环境变量不会覆盖赋值,越靠前具有更高优先级
不推荐针对不同环境配置不同的.env文件
构建开发Node server时配置端口号 PORT=40000
构建开发Node server时配置的域名 HOST=localhost
开发时配置opn库options参数app属性值,none不主动打开浏览器,不配置默认打开 BROWSER
打包生产文件夹项目路径 APP_BUILD=build
配置页面html文件路径 APP_HTML=public/index.html
项目public文件夹 APP_PUBLIC=public
入口JavaScript文件 APP_INDEXJS=src/index.js
项目源码目录 APP_SRC=src
生产打包JavaScript文件以及CSS文件是否生成source map文件,判定是否不等于字符串"false" GENERATE_SOURCEMAP=true
POSTCSS中是否进行px单位到rem单位到转换,判定是否等于字符串"true" PXTOREM=
CDN的url设置 PUBLIC_URL=/
是否采用HTTPS, 判定是否等于字符串"true" HTTPS=
样式文件是否采用css-modules, 判定是否等于字符串"true", 采用css-modules也留了一个缺口文件夹。源目录下的APP_SRC/assets文件夹不进行css modules处理 CSS_MODULES=
FAQs
Web开发启动脚本、打包脚本
The npm package web-scripts-ivan receives a total of 53 weekly downloads. As such, web-scripts-ivan popularity was classified as not popular.
We found that web-scripts-ivan demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A long-running Go typosquat impersonated the popular shopspring/decimal library and used DNS TXT records to execute commands.

Research
Active npm supply chain attack compromises @antv packages in a fast-moving malicious publish wave tied to Mini Shai-Hulud.

Security News
/Research
Socket detected malicious node-ipc versions with obfuscated stealer/backdoor behavior in a developing npm supply chain attack.