
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
webpack5-cos-plugin
Advanced tools
腾讯云 COS 上传插件, 可在 webpack 打包结束后将来 webpack 生成的文件自动上传到 COS 中。
特色
abc.js 这种不带 hash 值的文件, 可通过 existCheck: false 来取消该功能最佳实践:
js、css 文件设置 hash 值, eg: detail-question.34d71b4.jshtml 文件url-loader 自动打包到 js 文件中(base64)SecretId 只能访问指定文件夹npm install -D webpack-cos-plugin
注意: 需修改
webpackConfig.output.publicPath为 cos 路径对应的访问 url, eg:'//res.example.com/auto_upload_ci/your-project-name/'
用法一: 结合环境变量 (推荐)
// 先在 CI 的构建环境中设置以下环境变量:
// WEBPACK_QCCOS_PLUGIN_SECRET_ID 对应配置项 SecretId
// WEBPACK_QCCOS_PLUGIN_SECRET_KEY 对应配置项 SecretKey
// WEBPACK_QCCOS_PLUGIN_BUCKET 对应配置项 bucket
// WEBPACK_QCCOS_PLUGIN_REGION 对应配置项 region
// (可选, 默认为 'auto_upload_ci') WEBPACK_QCCOS_PLUGIN_COS_BASE_DIR 对应配置项 cosBaseDir
const QcCOSPlugin = require('webpack-cos-plugin')
webpackConfig.plugins.push(new QcCOSPlugin())
用法二: 设置配置项
const QcCOSPlugin = require('webpack-cos-plugin')
webpackConfig.plugins.push(new QcCOSPlugin({
auth: {
SecretId: '', // 在腾讯 COS 控制台获取
SecretKey: '', // 在腾讯 COS 控制台获取
},
bucket: {
Bucket: "ap-guangzhou", // COS 服务节点, 示例: oss-cn-hangzhou
Region: "sp-124879"// COS 存储空间, 在腾讯 COS 控制台获取
},
cosBaseDir: 'auto_upload_ci',
project: 'my-project-name', // 项目名(用于存放文件的直接目录)
}))
为了防止 COS 的 SecretId 及 SecretKey 被提交到代码仓库, 本插件提供了环境变量的支持, 所有参数及其环境变量对应关系参考下表。 构建函数中的参数优先级大于环境变量
参数列表如下所示:
| 构造参数 | 环境变量 | 默认值 | 说明 |
|---|---|---|---|
| SecretId | WEBPACK_QCCOS_PLUGIN_SECRET_ID | 空 | COS 访问 id |
| SecretKey | WEBPACK_QCCOS_PLUGIN_SECRET_KEY | 空 | COS 访问 key |
| Bucket | WEBPACK_QCCOS_PLUGIN_BUCKET | 空 | COS 存储空间 |
| Region | WEBPACK_QCCOS_PLUGIN_REGION | 空 | COS 服务节点 |
| exclude | - | /.*\.html$/ | 即匹配该正则的文件名 不会被上传到 COS |
| retry | - | 3 | 上传失败后重试次数, 0 代表不重试 |
| gzip | - | true | 是否在上传前进行 gzip 压缩 |
| existCheck | - | true | 上传前是否先检测已存在(已存在则不重复上传, 不存在才进行上传) |
| enableLog | WEBPACK_QCCOS_PLUGIN_ENABLE_LOG | false | 是否输出详细的日志信息 |
| ignoreError | WEBPACK_QCCOS_PLUGIN_IGNORE_ERROR | false | 上传过程中出现错误是否继续 webpack 构建 |
| removeMode | WEBPACK_QCCOS_PLUGIN_REMOVE_MODE | true | 生成的文件自动上传至 COS 后, 是否删除本地的对应文件 |
| useVersion | WEBPACK_QCCOS_PLUGIN_USE_VERSION | false | 是否在目录中添加版本号 |
| cosBaseDir | WEBPACK_QCCOS_PLUGIN_COS_BASE_DIR | auto_upload_ci | COS 中存放上传文件的一级目录名 |
| project | - | 默认会自动读取 package.json 中的 name | COS 中存放上传文件的二级目录, 一般为项目名 |
| version | - | 默认会自动读取 package.json 中的 version | COS 中存放上传文件的三级目录, 一般为版本号,仅在useVersion为true下有用 |
| options | - | undefined | 对象类型. 可用于设置文件的请求头、超时时间等 |
FAQs
Ali oss-webpack auto upload files plugin
The npm package webpack5-cos-plugin receives a total of 4 weekly downloads. As such, webpack5-cos-plugin popularity was classified as not popular.
We found that webpack5-cos-plugin demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.