
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Build a packager with bundle or run tsc directories, suitable for node|browser library package processing, It is implemented using esbuild
tsup is similar but focuses more on packet processing, powered by esbuild.
Install it locally in your project folder:
pnpm add xdw --dev
# Or Yarn
yarn add xdw --dev
You can also install it globally but it's not recommended.
xd [...file]
Files are written into ./dist.
You can bundle multiple files in one go:
xd src/index.ts src/bin/bin.ts
This will output dist/index.cjs.js; dist/index.esm.js and dist/bin.cjs.js; dist/bin.esm.js.
Unlike tsup, Xd is more suitable for a single independent entry file, Xd does not preserve the directory structure
xd [...directory]
Files are written into ./dist.
You can build dir in one go:
src
- bin
index.ts
index.ts
xd src
This will output:
dist
- bin
index.js
index.js
You can build multiple directories at once, but it is recommended to use only one directory as filename duplicates will be overwritten
use command --meta It works well on some monorepo (pnpm,yarn,npm) applications
LICENSE, README.md, CHANGELOG.md)package.publishConfig and carry package.jsonnode_modules lnk file to output(default dist)Like tsup, you can use the config file to configure
Supported file formats
xdw.config.tsxdw.config.jsxdw.config.cjsxdw.config.jsonimport { defineConfig } from 'xdw';
export default defineConfig({
entry: ['src/index.ts'],
splitting: false,
sourcemap: true,
clean: true
});
You can carry static resources that your project depends on
use command --assets aaa.png,xxx.vue,assetsDir
defines it like this in defineConfig
import { defineConfig } from 'xdw';
export default defineConfig({
assets: ['aaa.png', 'xxx.vue', 'assetsDir']
});
FAQs
Build a packager with bundle or run tsc directories, suitable for node|browser library package processing, It is implemented using esbuild
We found that xdw demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.