create-vue
LavaMoat
create-vue | LavaMoat | |
---|---|---|
19 | 16 | |
3,393 | 815 | |
2.3% | 1.6% | |
9.2 | 9.8 | |
6 days ago | 7 days ago | |
Vue | JavaScript | |
GNU General Public License v3.0 or later | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
create-vue
-
Volar with VueJS 3
I'm trying to use Volar https://github.com/vuejs/language-tools in a project created with create-vue https://github.com/vuejs/create-vue. My config is forked from https://github.com/LunarVim/nvim-basic-ide and Volar is installed with Mason (having previously installed the Vue lang server).
-
Prompt - User-friendly interactive prompts for Go.
Recently, I developed a go package that allows users to pass parameters through input or selection in tui. Similar to create-vue. You can see some screenshots in the README. Based on Bubble Tea. Inspired by Prompts.
-
I made browser extension for bookmarks (Vue 3 + TailwindCSS + IndexedDB)
Is there a reason you've used the old Vue CLI though, with webpack and babel?Imho you're missing a lot not using Vite... npm init vue@latest (create-vue) is the recommended way to scaffold a new Vue app, Vue CLI is in Maintenance Mode
-
Configuring vitest and testing library to work together
To start with, let's create a project with create-vue, executing the following command should create a brand new project:
-
ESLint + Prettier (Vue 3)
After creating a new Vue 3 application using either create-vue or vite do the following steps:
-
Exit Intent Pop-Up & How to Publish on NPM - Vue 3
npm init vue@latest This command will install and execute create-vue The recommended way to start a Vite-powered Vue project.
-
What am I missing? Why won't my app render?
The recommended way to create a skeleton Vue application these days is create-vue. I propose you use that tool to create a working Vue app and then add your HTML to it in small increments.
- Vite 3.0 is out!
-
Complex Vue 3 state management made easy with Pinia
This will install and execute create-vue, the official Vue project scaffolding tool, to setup a new project with Vue and Vite. In the process, you must choose the tools necessary for the project: Select all the tools marked with a red arrow: Router, Pinia, ESLint, and Prettier. When the setup completes, navigate to the project and install the dependencies:
-
NPM package compromised by author: erases files on RU / BY computers on install
Note that the only vulnerable version was @vue/cli v5.0.2, which was intended to pin the version of node-ipc to v9.2.1, but accidentally allowed versions greater than that: https://github.com/vuejs/vue-cli/commit/37ef809c873f33c88ba7...
The mistake was fixed within 6 minutes: https://github.com/vuejs/vue-cli/commit/b0d931668e7e8450a285...
It looks like the malware version of @vue/cli has been downloaded a total of 170 times.[1] That's 0.13% of all downloads of that package this week. It's also important to note that @vue/cli has been deprecated for months. If you're making a new Vue project today[2] you'll use create-vue[3] which doesn't depend on node-ipc at all.
1. https://www.npmjs.com/package/@vue/cli?activeTab=versions
2. https://vuejs.org/guide/quick-start.html
3. https://github.com/vuejs/create-vue
LavaMoat
-
Ledger's NPM account has been hacked
Just yesterday I watched a talk [0] at WarsawJS about LavaMoat [1], a set of tools to protect against malicious behaviour from npm dependencies. Guess itโs time to look into it deeper.
[0]: https://naugtur.pl/pres3/lava/2023end.html
[1]: https://github.com/LavaMoat/LavaMoat
-
Dozens of malicious PyPI packages discovered targeting developers
You are basically talking about Lavamoat. It provides tooling and policies for SES, which aims to make it into standards.
https://github.com/LavaMoat/LavaMoat
-
Supply chain security - prevent, not avoid
Enter: lavamoat. https://github.com/LavaMoat/LavaMoat
- LavaMoat: Tools for sandboxing your dependency graph
-
Deno.js in Production. Key Takeaways.
You should check out Lavamoat: https://github.com/LavaMoat/LavaMoat
It attempts to do what you're essentially describing. It was built by the MetaMask team, where supply chain attacks are an obviously huge risk.
I've spent some time trying to get it working in an app, but haven't been able to get it all the way working. It's still pretty beta and not well documented.
- Node.js packages don't deserve your trust
-
How to respond to growing supply chain security risks?
And it is happening right now. Github is opening the GitHub Advisory Database to community submissions. Awesome community NodeSecure builds cool things like scanner and js-x-ray. There are also lockfile-lint, LavaMoat, Jfrog-npm-tools (and I am sure there is more).
- On node-ipc and the importance of trusting trust
-
NPM package compromised by author: erases files on RU / BY computers on install
There is a proposal to add OCAPs on a language level in TC39[0]. There is already a drop-in implementation which already works in both Nodejs and browsers[1].
As a developer who wants to sandbox your own (recursive) dependencies, this is made accessible today in Lavamoat[2]. Basically a package or app can provide a policy manifest specifying which capabilities (e.g. network or filesystem access) should be granted for each dependency. Also comes with a tool that will auto-generate a starting point from your existing dependency tree.
IMO this is the future. Currently it does come with a performance penalty but hopefully this idea will catch on and make it into runtime implementations.
Lavamoat is still marked as "preprod" on npm but talking to the author it's a matter of days or weeks until the first stable release.
[0]: https://news.ycombinator.com/item?id=30703817
[1]: https://github.com/endojs/endo/tree/master/packages/ses
[2]: https://github.com/LavaMoat/LavaMoat
- Node runtime that sandboxes all NPM dependencies by default
What are some alternatives?
volar - โก Explore high-performance tooling for Vue [Moved to: https://github.com/vuejs/language-tools]
metamask-extension - :globe_with_meridians: :electric_plug: The MetaMask browser extension enables browsing Ethereum blockchain enabled websites
vitesse - ๐ Opinionated Vite + Vue Starter Template
vue-cli - ๐ ๏ธ webpack-based tooling for Vue.js Development
vite - Next generation frontend tooling. It's fast!
cli - the package manager for JavaScript
vetur - Vue tooling for VS Code.
handlebars-helpers - 188 handlebars helpers in ~20 categories. Can be used with Assemble, Ghost, YUI, express.js etc.
node-ipc - A nodejs module for local and remote Inter Process Communication (IPC), Neural Networking, and able to facilitate machine learning.
EventSource - a polyfill for http://www.w3.org/TR/eventsource/
vue-ts-eslint-template
proposal-shadowrealm - ECMAScript Proposal, specs, and reference implementation for Realms