
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
webpack-uri-search-hash
Advanced tools
Webpack plugin that appends content hashes to asset URLs via query strings.
A webpack 5 plugin that keeps emitted asset filenames stable on disk, but appends a content-derived query hash to the asset URLs webpack generates.
Instead of changing filenames like this:
main.abc123.jslazy.def456.cssthis plugin keeps the files themselves stable:
main.jslazy.cssbut rewrites the generated request URLs to include a hash in the query string:
main.js?hash=abc123...lazy.css?hash=def456...That gives you cache busting through the URL while preserving stable on-disk filenames.
mini-css-extract-plugin<script> and <link> tags generated by html-webpack-pluginnpm install -D webpack-uri-search-hash
You will typically also use it with webpack 5, and optionally:
html-webpack-pluginmini-css-extract-pluginconst UriSearchHashPlugin = require('webpack-uri-search-hash');
module.exports = {
output: {
filename: 'main.js',
chunkFilename: '[name].js',
},
plugins: [new UriSearchHashPlugin()],
};
With that setup, webpack can still emit files like:
main.jslazy.jsbut runtime chunk requests become:
lazy.js?hash=<contenthash>const MiniCssExtractPlugin = require('mini-css-extract-plugin');
const UriSearchHashPlugin = require('webpack-uri-search-hash');
module.exports = {
module: {
rules: [
{
test: /\.css$/i,
use: [MiniCssExtractPlugin.loader, 'css-loader'],
},
],
},
plugins: [
new MiniCssExtractPlugin({
filename: 'main.css',
chunkFilename: '[name].css',
}),
new UriSearchHashPlugin(),
],
};
Async CSS requests then become:
lazy.css?hash=<contenthash>const HtmlWebpackPlugin = require('html-webpack-plugin');
const MiniCssExtractPlugin = require('mini-css-extract-plugin');
const UriSearchHashPlugin = require('webpack-uri-search-hash');
module.exports = {
plugins: [
new MiniCssExtractPlugin({ filename: 'main.css' }),
new HtmlWebpackPlugin(),
new UriSearchHashPlugin(),
],
};
Generated tags become:
<script defer="defer" src="main.js?hash=<contenthash>"></script>
<link href="main.css?hash=<contenthash>" rel="stylesheet">
queryKeyType: string
Default: 'hash'
Controls the query parameter name.
new UriSearchHashPlugin({
queryKey: 'v',
});
Result:
lazy.js?v=<contenthash>hashFormatType: string
Default: '[contenthash]'
Controls how the hash value is rendered in the query string.
Supported forms follow webpack-style content hash placeholders:
[contenthash][contenthash:8]v-[contenthash:8]new UriSearchHashPlugin({
hashFormat: 'v-[contenthash:8]',
});
Result:
lazy.js?hash=v-1a2b3c4dYou can combine both options:
new UriSearchHashPlugin({
queryKey: 'version',
hashFormat: 'build-[contenthash:12]',
});
Result:
lazy.js?version=build-1a2b3c4d5e6fMIT
FAQs
Webpack plugin that appends content hashes to asset URLs via query strings.
We found that webpack-uri-search-hash demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.