
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
@a-la/import
Advanced tools
RegExp rules to transpile import statements into require calls (used in ÀLaMode).
@a-la/import
is a a set of rules for alamode
to transpile import
statements into require
calls in Node.JS.
ÀLaMode is a RegExp-based transpiler which works faster than AST-based transpilers such as @babel
, has no dependencies and occupies less disk space.
yarn add @a-la/import
The ÀLaImport is the default export and an array containing a sequence of rules for Replaceable.
import ÀLaImport from '@a-la/import'
ÀLaImport
SequenceThe rule set exported as an array by ÀLaImport
has multiple regexes and replacer functions to match all possible cases. The replacer functions expect to see the markers
property on the context, which is set by alamode
to access cut out strings. The transform can be run using @a-la/context
which is a lightweight version of alamode
which mimics its stream functionality.
/* yarn example/ */
import ÀLaContext from '@a-la/context'
import ÀLaImport from '@a-la/import'
const STRING = `import aLaMode from 'alamode'
import ALaImport from "@a-la/import"
import App from 'koa'
import test from './test'
`
;(async () => {
const context = new ÀLaContext(__filename)
context.setConfig({
import: {
alamodeModules: ['alamode', '@a-la/import'],
},
})
const { result } = await context.stream(ÀLaImport, STRING)
console.log(result)
})()
const aLaMode = require('alamode');
const ALaImport = require("@a-la/import");
let App = require('koa'); if (App && App.__esModule) App = App.default;
const test = require('./test');
The transform accepts a number of options via the .alamoderc
.
{
"env": {
"test-build": {
"import": {
"replacement": {
"from": "^((../)+)src",
"to": "$1build"
}
}
}
}
}
if (mod.__esModule)
check — by default, this check is switched off for local imports, but is added when requiring external packages to make it compatible with Babel and TypeScript.
{
"env": {
"test-build": {
"import": {
"esCheck": "always",
}
}
}
}
if (mod.__esModule)
is not required.If esCheck
is not set, and alamodeModules
does not contain the module that is being imported, the transform will attempt to find its package.json file, and see if it has the alamode
property set to true, in which case no esCheck will be appended.
The set of rules changes import
to require
statements. When importing a default export from a module, a check will included to see if it was transpiled with Babel
which is indicated by the presence of the __esModule
property, and if it was, then the default
property is reassigned to the variable.
import aLaMode from 'alamode'
import Koa from "koa"
import { methodA, methodB } from 'alamode'
import { methodC, methodD as aliasD } from 'alamode'
import defaultALaMode, {
methodE, methodF,
} from 'alamode'
import def, * as tests from './tests'
const aLaMode = require('alamode');
let Koa = require("koa"); if (Koa && Koa.__esModule) Koa = Koa.default;
const { methodA, methodB } = require('alamode');
const { methodC, methodD: aliasD } = require('alamode');
const defaultALaMode = require('alamode'); const {
methodE, methodF,
} = defaultALaMode;
const tests = def = require('./tests');
The transform will attempt to preserve lines as they are for easier generation of source maps by alamode
. In future, this might change.
The named imports are only changed to replace as
into :
, otherwise the destructuring syntax is the same as for imports themselves.
import { test, test2,
test3 as alias3 }
from 'package'
const { test, test2,
test3: alias3 }
= require('package');
When there is a default import along with named once, the line numbers will be respected.
import def, {
test, test2,
test3 as alias3,
test4
as
alias4,
}
from
'package'
let def = require('package'); const {
test, test2,
test3: alias3,
test4
:
alias4,
}
=
def; if (def && def.__esModule) def = def.default;
import defaultExport from "module-name"
import * as name from "module-name";
import { export } from "module-name";
import { export as alias } from "module-name";
import { export1 , export2 } from "module-name";
import { export1 , export2 as alias2 , [...] } from "module-name";
import defaultExport, { export [ , [...] ] } from "module-name";
import defaultExport, * as name from "module-name";
import "module-name";
var promise = import(module-name);
from 'package'
handling when matchers' logic is updated in the restream
.
![]() | © Art Deco™ for À La Mode 2020 |
---|
renameOnly
property of the stream.FAQs
RegExp rules to transpile import statements into require calls (used in ÀLaMode).
The npm package @a-la/import receives a total of 22 weekly downloads. As such, @a-la/import popularity was classified as not popular.
We found that @a-la/import demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.