
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@uni-helper/plugin-uni
Advanced tools
为 uni-app 提供的 原生 ESM Vite 插件,让你在 ESM-First 环境中零成本接入 uni-app 构建体系。
[!TIP]
零运行时影响
本包仅为 ESM 重导出,无额外逻辑,因此不会增加构建耗时或引入潜在缺陷。
问题归属
如遇构建异常,请先确认是否由官方插件引起,并向 dcloudio/uni-app 提交 issue;
若可定位为转发层缺陷,请附最小复现仓库至 @uni-helper/plugin-uni。
维护计划
将持续跟进官方 ESM 支持进度;一旦官方提供原生 ESM 版本,本项目将归档并停止维护。
| 特性 | 说明 |
|---|---|
| 🚀 原生 ESM | 完全遵循 import/export 规范,无需 .default() 适配 |
| 🛡️ 完整类型 | TypeScript 类型与 @dcloudio/vite-plugin-uni 同步,IDE 提示零丢失 |
| 🪶 零依赖转发 | 通过 peerDependencies 复用用户项目中的官方插件,不锁版本 |
| 🧩 即装即用 | 一行 import,即可替换官方 CJS 插件 |
npm i -D @uni-helper/plugin-uni
[!IMPORTANT] 请确保已安装官方插件
@dcloudio/vite-plugin-uni,否则本插件将无法正常工作。
{
"type": "module",
"devDependencies": {
"@dcloudio/vite-plugin-uni": "xxx",
"@uni-helper/plugin-uni": "^0.1.0"
}
}
import Uni from '@uni-helper/plugin-uni'
// vite.config.ts
import { defineConfig } from 'vite'
export default defineConfig({
plugins: [
Uni({ /* 同官方配置 */ })
]
})
d.ts文件,确保类型与官方插件一致。FAQs
uni-app plugin 的 ESM 导出
The npm package @uni-helper/plugin-uni receives a total of 534 weekly downloads. As such, @uni-helper/plugin-uni popularity was classified as not popular.
We found that @uni-helper/plugin-uni demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.