Gathering detailed insights and metrics for catalyst-frontend
Gathering detailed insights and metrics for catalyst-frontend
A configurable frontend build pipeline that caters for everything from simple SASS compilation only, right through to ES2015 plus React.
Installations
npm install catalyst-frontendDeveloper Guide
BETA
Typescript
No
Module System
CommonJS
Node Version
18.12.1
NPM Version
8.19.2
Releases
Unable to fetch releases
Languages
6
JavaScript
TypeScript
MDX
SCSS
CSS
HTML
JavaScript (70.55%)
TypeScript (12.92%)
MDX (7.62%)
SCSS (4.02%)
CSS (3.07%)
HTML (1.82%)
Developer
catalyst
Download Statistics
Total Downloads
0
Last Day
0
Last Week
0
Last Month
0
Last Year
0
GitHub Statistics
NOASSERTION License
3 Stars
132 Commits
6 Forks
4 Watchers
24 Branches
12 Contributors
Updated on Feb 21, 2023
Maintainers
2
Package Meta Information
Latest Version
1.4.1
Package Id
catalyst-frontend@1.4.1
Unpacked Size
1.81 MB
Size
825.43 kB
File Count
101
NPM Version
8.19.2
Node Version
18.12.1
Published on
Sep 04, 2023
Total Downloads
Cumulative downloads
Total Downloads
NaN
Last Day
0%
NaN
Compared to previous day
Last Week
0%
NaN
Compared to previous week
Last Month
0%
NaN
Compared to previous month
Last Year
0%
NaN
Compared to previous year
Weekly Downloads
Monthly Downloads
Yearly Downloads
catalyst-frontend
A configurable frontend build pipeline that caters for everything from simple SASS compilation only, right through to ES2015 plus React.
Available functionality
This opinionated tool (as used at Catalyst) aims to get you up and running with one of two configurable frontend build pipelines (Gulp or Webpack). It generates documentation to get you started and gives you the config files so you can tweak them further yourself if you like.
Gulp pipeline
For simple projects where you are not intending to utilise ES2015.
Basic functionality:
- SASS (.scss) support
- Autoprefixer
- CSS minification with cssnano
- PostCSS Flexbugs Fixes
- CSS sourcemaps
- A basic .editorconfig
- Choice of project structures
Optional functionality:
- Browsersync integration for auto-reloading
- JS file concatenation and minification
- sourcemaps
- jQuery
- Bootstrap CSS - choice of Boostrap 3 or 4
- Bootstrap JS
Webpack pipeline
For projects where you want to use ES6 transpilation.
Basic functionality:
- ES2015 transpilation with Babel (plus plugin-proposal-object-rest-spread)
- SASS (.scss) support
- Autoprefixer
- CSS minification with cssnano
- PostCSS Flexbugs Fixes
- Webpack build process
- webpack-dev-server with hot reload
- sourcemaps
- production build command
- A basic .editorconfig
- Linting with eslint
- babel-polyfill, whatwg-fetch and es6-promise support for older browsers
Optional functionality:
- React and hot loading
- Jest for testing
- Bootstrap 4
Installation
We assume you have pre-installed node.js (for a Ubuntu package managed version see the package manager instructions) at least version 6.
Install catalyst-frontend for global use (you may need to run this command as root):
1npm install -g catalyst-frontend
Usage
From the location where you want your project to be located, generate your new project:
1catalyst-frontend
You'll be asked questions about your project and the build pipeline will be built according to your answers.
Storing configuration
When you run the generator a .yo-rc.json file will be generated that remembers
the answers you provided. If you want to force the project to re-ask you the
questions next time, just re-run with the --reconfigure flag set.
1catalyst-frontend --reconfigure
TODO
- Ask for project setup parameters e.g. tabs vs whitespaces, semicolons or not
License
GPL-3.0 © Catalyst
No vulnerabilities found.
Reason
no dangerous workflow patterns detected
Reason
no binaries found in the repo
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Warn: project license file does not contain an FSF or OSI license.
Reason
dependency not pinned by hash detected -- score normalized to 3
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/npm-publish.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/catalyst/catalyst-frontend/npm-publish.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/npm-publish.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/catalyst/catalyst-frontend/npm-publish.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/npm-publish.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/catalyst/catalyst-frontend/npm-publish.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/npm-publish.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/catalyst/catalyst-frontend/npm-publish.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/npm-publish.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/catalyst/catalyst-frontend/npm-publish.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/npm-publish.yml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/catalyst/catalyst-frontend/npm-publish.yml/master?enable=pin
- Info: 0 out of 6 GitHub-owned GitHubAction dependencies pinned
- Info: 3 out of 3 npmCommand dependencies pinned
Reason
Found 2/18 approved changesets -- score normalized to 1
Reason
0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/npm-publish.yml:1
- Info: no jobLevel write permissions found
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
security policy file not detected
Details
- Warn: no security policy file detected
- Warn: no security file to analyze
- Warn: no security file to analyze
- Warn: no security file to analyze
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
branch protection not enabled on development/release branches
Details
- Warn: branch protection not enabled for branch 'master'
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 29 are checked with a SAST tool
Reason
57 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-prr3-c3m5-p7q2
- Warn: Project is vulnerable to: GHSA-968p-4wvh-cqc8
- Warn: Project is vulnerable to: GHSA-67hx-6x53-jw92
- Warn: Project is vulnerable to: GHSA-qwcr-r2fm-qrc7
- Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw
- Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
- Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
- Warn: Project is vulnerable to: GHSA-rv95-896h-c2vc
- Warn: Project is vulnerable to: GHSA-qw6h-vgh9-j6wx
- Warn: Project is vulnerable to: GHSA-jchw-25xp-jwwc
- Warn: Project is vulnerable to: GHSA-cxjh-pqwp-8mfp
- Warn: Project is vulnerable to: GHSA-c7qv-q95q-8v27
- Warn: Project is vulnerable to: GHSA-4www-5p9h-95mh
- Warn: Project is vulnerable to: GHSA-9gqv-wp59-fq42
- Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
- Warn: Project is vulnerable to: GHSA-mwcw-c2x4-8c55
- Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j
- Warn: Project is vulnerable to: GHSA-rhx6-c78j-4q9w
- Warn: Project is vulnerable to: GHSA-7fh5-64p2-3v2j
- Warn: Project is vulnerable to: GHSA-m6fv-jmcg-4jfg
- Warn: Project is vulnerable to: GHSA-76p7-773f-r4q5
- Warn: Project is vulnerable to: GHSA-cm22-4g7w-348p
- Warn: Project is vulnerable to: GHSA-4vvj-4cpr-p986
- Warn: Project is vulnerable to: GHSA-wr3j-pwj9-hqq6
- Warn: Project is vulnerable to: GHSA-4v9v-hfq4-rm2v
- Warn: Project is vulnerable to: GHSA-9jgg-88mc-972h
- Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q
- Warn: Project is vulnerable to: GHSA-93q8-gq69-wqmw
- Warn: Project is vulnerable to: GHSA-fwr7-v2mv-hh25
- Warn: Project is vulnerable to: GHSA-cph5-m8f7-6c5x
- Warn: Project is vulnerable to: GHSA-wf5p-g6vw-rhxx
- Warn: Project is vulnerable to: GHSA-jr5f-v2jv-69x6
- Warn: Project is vulnerable to: GHSA-gxpj-cx7g-858c
- Warn: Project is vulnerable to: GHSA-w573-4hg7-7wgq
- Warn: Project is vulnerable to: GHSA-phwq-j96m-2c2q
- Warn: Project is vulnerable to: GHSA-ghr5-ch3p-vcr6
- Warn: Project is vulnerable to: GHSA-2j2x-2gpw-g8fm
- Warn: Project is vulnerable to: GHSA-74fj-2j2h-c42q
- Warn: Project is vulnerable to: GHSA-pw2r-vq6v-hr8c
- Warn: Project is vulnerable to: GHSA-ww39-953v-wcq6
- Warn: Project is vulnerable to: GHSA-pfrx-2q88-qq97
- Warn: Project is vulnerable to: GHSA-43f8-2h32-f4cj
- Warn: Project is vulnerable to: GHSA-29mw-wpgm-hmr9
- Warn: Project is vulnerable to: GHSA-35jh-r3h4-6jhm
- Warn: Project is vulnerable to: GHSA-f8q6-p94x-37v3
- Warn: Project is vulnerable to: GHSA-xvch-5gv4-984h
- Warn: Project is vulnerable to: GHSA-8hfj-j24r-96c4
- Warn: Project is vulnerable to: GHSA-wc69-rhjr-hc9g
- Warn: Project is vulnerable to: GHSA-r683-j2x4-v87g
- Warn: Project is vulnerable to: GHSA-hj48-42vr-x3v9
- Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
- Warn: Project is vulnerable to: GHSA-jv35-xqg7-f92r
- Warn: Project is vulnerable to: GHSA-4rq4-32rv-6wp6
- Warn: Project is vulnerable to: GHSA-64g7-mvw6-v9qj
- Warn: Project is vulnerable to: GHSA-j8xg-fqg3-53r7
- Warn: Project is vulnerable to: GHSA-c4w7-xm78-47vh
Score
2.8
/10
Last Scanned on 2025-07-07
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More