Research
Security News
Malicious PyPI Package ‘pycord-self’ Targets Discord Developers with Token Theft and Backdoor Exploit
Socket researchers uncover the risks of a malicious Python package targeting Discord developers.
xgplayer-service-miniprogram
Advanced tools
#点播视频地址获取SDK(微信小程序版本)
小程序支持的第三方npm存在诸多约束:
{
"name": "miniprogram-custom-component",
"version": "1.0.0",
"description": "",
"miniprogram": "dist",
"devDependencies": {},
"dependencies": {}
}
小程序 npm 包里只有构建文件生成目录会被算入小程序包的占用空间,上传小程序代码时也只会上传该目录的代码。如果小程序 npm 包有一些测试、构建相关的代码请放到构建文件生成目录外。另外也可以使用.npmignore文件来避免将一些非业务代码文件发布到 npm 中。
测试、构建相关的依赖请放入 devDependencies 字段中避免被一起打包到小程序包中。
⚠️不支持依赖 nodejs 的内置库,比如 http, axios等等,替代策略可以是自己封装📦一个基于微信小程序内部http请求的api(wx.request)的想网络请求轮子,或者使用 flyio 支持度,版本兼容行都挺好
微信小程序的环境(jscore),JsCore是一个没有窗口对象的环境, window, XmlHttpRequest等不能使用
npm install xgplayer-service-miniprogram --production
PS: 该安装目录可以是 根目录下的各个子目录,比如dist目录, 但不允许 node_modules 在小程序根目录外。 如果选择的安装目录不存在node_modules文件夹, 可以自建,或者先执行一遍 npm init 命令(否则后面开发者工具会报,不存在构建的npm包的错误)
为兼容不同的开发者工具版本,使用 --production 最好
构建npm包
打开开发者工具菜单的工具栏,选择-->构建npm
如果报错,则第一步存在问题,查明原因再试
在开发者工具 详情栏 勾选 '使用npm模块'
项目中引入使用构建的npm
const myPackage = require('xgplayer-service-miniprogram')
const service = myPackage()
service.url(token)
.then(res => {
console.log(res)
// 业务todo
})
.catch(err => {
console.log(err)
})
原生小程序,mpvue框架 按照正常步骤是无异常的,wepy框架下需要正确使用构建的npm包路径,可能原因是wepy打包第三方npm包的方式不同,构建时会发现存在miniprogram_npm和npm两个文件夹,npm中的包是全局可用的,所以可以将miniprogram_npm中需要的包复制到npm文件夹即可。
FAQs
video player service for byted cloud (miniprogram version)
The npm package xgplayer-service-miniprogram receives a total of 2 weekly downloads. As such, xgplayer-service-miniprogram popularity was classified as not popular.
We found that xgplayer-service-miniprogram demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover the risks of a malicious Python package targeting Discord developers.
Security News
The UK is proposing a bold ban on ransomware payments by public entities to disrupt cybercrime, protect critical services, and lead global cybersecurity efforts.
Security News
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.