Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
@a-la/import
Advanced tools
@a-la/import
is a a set of rules for alamode
to transpile the import
statement into a require
call in Node.js.
À La Mode is a RegExp-based transpiler which works faster than AST-based transpilers such as @babel
, has fewer dependencies, and occupies less disk space.
yarn add -E @a-la/import
The ALaImport is the default export and an array containing a sequence of rules for Replaceable.
import ALaImport from '@a-la/import'
ALaImport
SequenceThe rule set exported as an array by ALaImport
has multiple regexes and replacer functions to match all possible cases. The replacer functions expect to see the matchers
property on the context, which is set by alamode
to access cut out strings. The transform can be run using @a-la/context
which is a lightweight version of alamode
which mimics its stream functionality.
/* yarn example/ */
import ALaContext from '@a-la/context'
import ALaImport from '@a-la/import'
const STRING = `import aLaMode from 'alamode'
import ALaImport from "@a-la/import"
import App from 'koa'
import test from './test'
`
;(async () => {
const context = new ALaContext()
const { result } = await context.stream(ALaImport, STRING)
console.log(result)
})()
let aLaMode = require('alamode'); if (aLaMode && aLaMode.__esModule) aLaMode = aLaMode.default;
let ALaImport = require("@a-la/import"); if (ALaImport && ALaImport.__esModule) ALaImport = ALaImport.default;
let App = require('koa'); if (App && App.__esModule) App = App.default;
const test = require('./test');
The transform accepts a number of options via the .alamoderc
.
replacement
option is used to substitute the name or path of an imported module.
{
"env": {
"test-build": {
"import": {
"replacement": {
"from": "^((../)+)src",
"to": "$1build"
}
}
}
}
}
esCheck
option is used to always enforce the if (mod.__esModule)
check -- by default, this is switched off for local imports, but is added when requiring external packages to make it compatible with Babel and TypeScript.
{
"env": {
"test-build": {
"import": {
"esCheck": "always",
}
}
}
}
The set of rules changes import
to require
statements. When importing a default module, a check will be made to see if it was transpiled with Babel
which is indicated by the presence of the __esModule
property, and if it was, then the default
property is reassinged to the variable.
import aLaMode from 'alamode'
import scopeALaMode from "@a-la/import"
import { methodA, methodB } from 'alamode'
import { methodC, methodD as aliasD } from 'alamode'
import defaultALaMode, {
methodE, methodF,
} from 'alamode'
import def, * as tests from './tests'
let aLaMode = require('alamode'); if (aLaMode && aLaMode.__esModule) aLaMode = aLaMode.default;
let scopeALaMode = require("@a-la/import"); if (scopeALaMode && scopeALaMode.__esModule) scopeALaMode = scopeALaMode.default;
const { methodA, methodB } = require('alamode');
const { methodC, methodD: aliasD } = require('alamode');
let defaultALaMode = require('alamode'); const {
methodE, methodF,
} = defaultALaMode; if (defaultALaMode && defaultALaMode.__esModule) defaultALaMode = defaultALaMode.default;
const tests = def = require('./tests');
The transform will attempt to preserve lines as they are for easier generation of source maps by alamode
. In future, this might change.
The named imports are only changed to replace as
into :
, otherwise the destructuring syntax is the same as for imports themselves.
import { test, test2,
test3 as alias3 }
from 'package'
const { test, test2,
test3: alias3 }
= require('package');
When there is a default import along with named once, the line numbers will be respected.
import def, {
test, test2,
test3 as alias3,
test4
as
alias4,
}
from
'package'
let def = require('package'); const {
test, test2,
test3: alias3,
test4
:
alias4,
}
=
def; if (def && def.__esModule) def = def.default;
import defaultExport from "module-name"
import * as name from "module-name";
import { export } from "module-name";
import { export as alias } from "module-name";
import { export1 , export2 } from "module-name";
import { export1 , export2 as alias2 , [...] } from "module-name";
import defaultExport, { export [ , [...] ] } from "module-name";
import defaultExport, * as name from "module-name";
import "module-name";
var promise = import(module-name);
__esModule
check for specified packages.from 'package'
handling when matchers' logic is updated in the restream
.(c) À La Mode 2018
1.7.0
__esModule
check to modules imported locally.FAQs
RegExp rules to transpile import statements into require calls (used in ÀLaMode).
The npm package @a-la/import receives a total of 20 weekly downloads. As such, @a-la/import popularity was classified as not popular.
We found that @a-la/import demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.