
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
create-sourcebit
Advanced tools
An interactive setup process for Sourcebit
Sourcebit uses a configuration file of sourcebit.js to define and configure all of its plugins. While this file can be created manually, this command-line interface provides an interactive setup that gathers enough information about the user's environment and content architecture to create a working configuration.
Every Sourcebit plugin must define the questions that should be asked and process the answers. This takes place via the getSetup and getOptionsFromSetup methods.
The list of plugins offered by the interactive setup process is pulled from the plugins.json file in the root of the repository. It's an array of objects with the following properties:
module (String): The name of the plugin's npm module
sourcebit-source-contentfuldescription (String): A human-friendly description of the plugin
A Contentful source plugin for Sourcebitauthor (String): The name/handle of the plugin's author
John Doe <john.doe@example.com>type (enum: source|target): The type of plugin
sourceplugins.json
[
{
"module": "/Users/eduardoboucas/Sites/sourcebit-source-contentful",
"description": "A Contentful source plugin for Sourcebit",
"author": "Stackbit",
"type": "source"
},
{
"module": "/Users/eduardoboucas/Sites/sourcebit-target-jekyll",
"description": "A Sourcebit plugin for Jekyll",
"author": "Stackbit",
"type": "target"
}
]
You can create your own plugins.json file and tell the setup process to use it. This is useful when you're developing a plugin locally and you want it to appear on the list of available plugins without having to publish it to the official registry.
To use a local plugin registry, create a file with the structure above and start the setup process with the --plugins flag pointing to its path.
npx create-sourcebit --plugins=./my-plugins.json
FAQs
Create and configure a Sourcebit installation
The npm package create-sourcebit receives a total of 3 weekly downloads. As such, create-sourcebit popularity was classified as not popular.
We found that create-sourcebit demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 11 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.