
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
webpack-impact-scope-plugin
Advanced tools
在构建时自动分析代码改动影响面,支持 Mpx 组件/页面依赖反向追溯。
pnpm add -D webpack-impact-scope-plugin
在 mpx.config.js 或 webpack.config.js 中引入并配置:
const { ImpactScopeWebpackPlugin } = require('webpack-impact-scope-plugin');
module.exports = {
plugins: [
new ImpactScopeWebpackPlugin({
commit: 'HEAD', // 可选,默认取当前分支最新 commit
branch: 'main', // 可选,与指定 branch 对比差异
outputPath: './impact-report', // 输出目录
enablePreview: true // 是否启用预览服务器
})
]
};
构建完成后,控制台会打印变更模块信息,同时生成 JSON 报告和 HTML 可视化文件。
| 字段 | 类型 | 默认值 | 说明 |
|---|---|---|---|
| commit | string | - | 对比的 Git 提交(SHA 或分支) |
| branch | string | - | 若提供,则与当前分支做 diff |
| outputPath | string | 'impact-report' | 报告输出目录 |
| enablePreview | boolean | false | 是否启动预览服务器并自动打开浏览器 |
控制台摘要:
Changed modules saved to .../changed-modules.json
Visualization generated at .../visualizer.html
Visualization server started at http://localhost:8088/visualizer.html
HTML 报告预览:
你也可以在 Node 脚本里复用底层模块:
const { GitDiffCollectorImpl } = require('webpack-impact-scope-plugin/src/git-diff-collector');
const { generateChangedModulesHtml } = require('webpack-impact-scope-plugin/src/visualizer');
// 示例:生成 HTML
generateChangedModulesHtml(changedModulesData, 'output.html');
# 安装依赖
pnpm i
# 运行单元测试
pnpm test
# 在 e2e 示例中验证
cd e2e/mpx-demo
npm run build
FAQs
We found that webpack-impact-scope-plugin demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.