Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
This Bridgetown plugin integrates with Directus, which is among other things a headless CMS. The plugin allows Bridgetown to pull content from a Directus API during the build process and generate static content in your site. It supports both single-language and multilingual content through Directus translations.
Before installing the plugin make sure you have an Auth Token in your Directus instance.
Run the plugin's automation setup:
bin/bridgetown apply https://github.com/munkun-estudio/bridgetown_directus
The setup will guide you through:
Add the gem to your Gemfile:
bundle add "bridgetown_directus"
Run bundle install to install the gem.
Add the plugin configuration to your config/initializers.rb file:
init :"bridgetown_directus" do
api_url "https://your-directus-instance.com"
token ENV['DIRECTUS_AUTH_TOKEN'] || "your_token"
collection config.directus["collection"]
mappings config.directus["mappings"]
end
Configure your bridgetown.config.yml:
directus:
collection: "posts"
mappings:
title: "title" # Required field
content: "body" # Required field
slug: "slug" # Optional, will be auto-generated if not provided
date: "date" # Optional, defaults to current date/time if not provided
category: "category" # Optional
excerpt: "excerpt" # Optional, defaults to content excerpt if not provided
image: "image" # Optional, URL for the image associated with the post
translations:
enabled: false # Set to true for multilingual support
fields: # Only required if translations are enabled
- title
- excerpt
- body
You can configure the plugin either through environment variables or direct configuration:
Using environment variables:
export DIRECTUS_API_URL="https://your-directus-instance.com"
export DIRECTUS_AUTH_TOKEN="your-token"
Or through bridgetown.config.yml as shown in the installation section.
To enable multilingual support:
In your bridgetown.config.yml, set translations.enabled to true:
directus:
# ... other config ...
translations:
enabled: true
fields:
- title
- excerpt
- body
Ensure your Directus collection has translations enabled and configured for the specified fields.
The plugin will automatically:
Once the plugin is installed and configured, it will fetch posts from your Directus instance during each build. These posts will be generated as in-memory resources, meaning they are not written to disk but are treated as normal posts by Bridgetown.
Create a collection in your Directus instance with these fields:
Make sure the status field uses "published"
for posts that you want to be visible on your site.
If your posts contain images, and you want to display them in your Bridgetown site, you'll need to ensure that the directus_files collection has the appropriate permissions for public access.
Public Role Configuration:
Image Uploads and Management:
Posts are fetched from Directus during each build and treated as Bridgetown resources. These resources are available in your site just like regular posts, and you can access them through your templates or layouts.
By default, only posts with a status of "published" are fetched from Directus.
Here are features that are planned for future versions of the plugin:
Testing isn't fully set up yet, but contributions and improvements are welcome.
We welcome contributions! To contribute:
FAQs
Unknown package
We found that bridgetown_directus demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.