Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Default webpack development and production configuration.
The goal of weldable
is to make it easier to install webpack
build packages and be up and running with a basic
development
or production
build with minimal preferences.
weldable
is intended...
weldable
base using the CLI extend option. -x ./webpack.exampleConfig.js
.weldable
uses).If weldable doesn't work for you, you can always go back to the webpack
project init
command
The basic requirements:
There appear to be dependency mapping issues with
Yarn
v1.x.x lock files,Typescript
andwebpack
, and specific dependencies using ES modules. If you do decide to use Yarn use the latest version.
NPM install...
$ npm i weldable --save-dev
or Yarn
$ yarn add weldable --dev
For in-depth use of weldable
see our DOCS.
$ weldable --help
Use a webpack configuration for development and production.
Usage: weldable [options]
Options:
-e, --env Use a default configuration type if NODE_ENV is not set to the available choices.
[string] [choices: "development", "production"] [default: "production"]
-l, --loader Preprocess loader, use the classic JS (babel-loader), TS (ts-loader), or "none" to use webpack defaults, or a different loader.
[string] [choices: "none", "js", "ts"] [default: "js"]
-s, --stats Stats output level for NodeJS API
[string] [choices: "errors-only", "errors-warnings", "minimal", "none", "normal", "verbose", "detailed", "summary"] [default: "normal"]
--standalone Standalone webpack configuration. Output weldable webpack config functions and update package.json so you can do whatever you want.
[boolean] [default: false]
--statsFile Output JSON webpack bundle stats. Use the default, or a relative project path and filename [./stats.json] [string]
--tsconfig Generate a base tsconfig from NPM @tsconfig/[base]. An existing tsconfig.json will override this option, see tsconfig-opt. This option can
be run without running webpack. [string] [choices: "", "create-react-app", "node18", "node20", "react-native", "recommended", "strictest"]
--tsconfig-opt Regenerate or merge a tsconfig [string] [choices: "merge", "regen"]
-x, --extend Extend, or override, the default configs with your own relative path webpack configs using webpack merge. [array]
-h, --help Show help [boolean]
-v, --version Show version number [boolean]
Example NPM scripts
A basic development start, and production build, using your own op
"scripts": {
"start": "weldable -e development",
"build": "weldable"
}
A development start, and production build, using your own webpack configurations merged with the defaults.
"scripts": {
"start": "weldable -e development -x ./webpack.yourCustomBuild.js -x ./webpack.developmentBuild.js",
"build": "weldable -x ./webpack.yourCustomBuild.js -x ./webpack.productionBuild.js"
}
The lib
aspect of weldable
is exported as CommonJS and is intended to be run as part of your build process without the need to install many additional packages.
Two primary things are exposed through weldable
...
webpack-merge
weldable
"helper" functionsExample packages use...
const packages = require('weldable/lib/packages');
const aPackage = packages.[PACKAGE_NAME];
Example helper function use...
const { dotenv } = require('weldable');
const dotenvFunc = dotenv.[FUNC];
A listing of exposed packages and weldable functions can be found under our DOCS or
package.json dependencies
.
This project is influenced by Create React App and other packaging tools.
Contributing? Guidelines can be found here CONTRIBUTING.md.
FAQs
A webpack configuration tool.
We found that weldable demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.