Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/kmova/sprig
The Go language comes with a built-in template language, but not very many template functions. This library provides a group of commonly used template functions.
It is inspired by the template functions found in Twig and also in various JavaScript libraries, such as underscore.js.
Template developers can read the Sprig function documentation to learn about the >100 template functions available.
For Go developers wishing to include Sprig as a library in their programs, API documentation is available at GoDoc.org, but read on for standard usage.
To load the Sprig FuncMap
:
import (
"github.com/Masterminds/sprig"
"html/template"
)
// This example illustrates that the FuncMap *must* be set before the
// templates themselves are loaded.
tpl := template.Must(
template.New("base").Funcs(sprig.FuncMap()).ParseGlob("*.html")
)
By convention, all functions are lowercase. This seems to follow the Go idiom for template functions (as opposed to template methods, which are TitleCase).
Example:
{{ "hello!" | upper | repeat 5 }}
Produces:
HELLO!HELLO!HELLO!HELLO!HELLO!
The following principles were used in deciding on which functions to add, and determining how to implement them.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.