Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Security News
Sarah Gooding
June 13, 2024
Ecma TC39 (Technical Committee 39) delegates concluded their 102nd meeting this week in Finland. TC39 is responsible for developing and maintaining the ECMAScript programming language specification. Major changes to ECMAScript happen through a rigorous, six-stage proposal process, and this meeting was an opportunity for prospective new features and changes to gain the committee’s approval for moving forward.
Earlier this week, we covered the first four proposals that were advanced:
Four more proposals, which we didn’t cover in the first roundup, were advanced over the course of the three-day TC39 meeting, including the following:
The Joint Iteration proposal has now given four presentations to the committee since 2023 and is moving into Stage 2.7. This designation is “approved in principle and undergoing validation,” according to the TC39 Process docs. It is used for proposals that are complete where no further work is possible without feedback from tests, implementations, or usage.
Joint Iteration aims to enable simultaneous iteration over multiple iterables, which would enhance ECMAScript’s capabilities for handling complex iteration scenarios.
The slides for the June 2024 presentation outline the proposed APIs:
The presentation also summarized the current open issues for the proposal on GitHub. A live demo of Joint iteration is available so developers can open the console and see how it works.
ESM Phase Imports would allow modules to control the initialization timing of their dependencies. This enables better performance and more predictable loading behavior, benefiting applications with complex dependency chains. The proposal is aimed at improving runtime and tooling support for workers, which should enable faster JavaScript applications.
The Discard Bindings proposal introduces syntax to explicitly discard unused variables in destructuring assignments. This helps developers avoid creating unnecessary bindings, leading to cleaner and more efficient code.
Developers would be able to signal they don’t care about the value of a variable or property during assignment, potentially improving code readability and avoiding the need for unused temporary variables. Discard Bindings has a number of potential use cases the proposal is investigating, including discards in variable bindings, object binding and assignment patterns, callback parameters, class method parameters, extractors, and more.
Check out the June 2024 presentation slides for a quick overview.
The Iterator Sequencing proposal would allow for the creation of iterators by enabling existing iterators to be consumed in a sequence. This feature would provide a standardized way to manage and sequence asynchronous and synchronous iteration, leading to more predictable and maintainable code.
The next TC39 meeting is scheduled for July 2024, and will be held as a virtual meeting, where further advancements and new proposals will be discussed. Stay tuned for more updates on ECMAScript's evolution!
Subscribe to our newsletter
Get notified when we publish new security blog posts!
Try it now
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.