Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
@actus/core
Advanced tools
This is the machine and inner core of the Actus command bar.
It consists of a Finite State Machine, an input parser, and a result ranking algorithm (self learning).
npm install @actus/core
See the Svelte example in packages/
for more detailed info.
import { interpret, filterAndSort, selectionMachine } from "@actus/core";
const selectionService = interpret(selectionMachine);
const commands = [
{
id: "1",
title: "My command",
description: "My description",
exec: () => {
console.log("Executed!");
},
},
];
selectionService.send("NEW_COMMANDS", commands);
// Bind it to the UI of choice and send events
// when the user inputs something or clicks on a result
selectionService.send("INPUT", "m");
selectionService.send("EXEC", "1");
Have a look at src/selection-machine.ts to see the machine and its services / actions / guards implementations.
Here's a visaulization of the machine:
Type definition of a command:
type Command = {
id: string;
title: CommandTitle;
description: CommandDescription;
exec: ExecutionFn;
getMatchString?: GenerateMatchStringFn;
requiredArgs?: string[];
};
type CommandTitle = string | CommandTitleFn;
type CommandTitleFn = (input: ParserResult) => string;
type CommandDescription = string | CommandDescriptionFn;
type CommandDescriptionFn = (input: ParserResult) => string;
type ExecutionFn = (command: Command, input: ParserResult) => void;
type GenerateMatchStringFn = (input: ParserResult) => string;
type ParserResult = [string] | [string, ParserParams] | null;
type ParserParams = {
[key: string]: string;
};
The parser is built using Nearley.
Check out src/grammar/parse-input.ne for the grammar.
Here's what the parse outputs:
type ParserResult = [string] | [string, ParserParams] | null;
type ParserParams = {
[key: string]: string;
};
Examples:
hello -> ["hello"]
hello -p -> ["hello", {p: null}]
hello -p 1 -> ["hello", {p: "1"}]
hello -p 1 -r "hello x" -> ["hello", {p: "1", r: "hello x"}]
hello -p " -> null (broken string)
It's self learning in the sense that it ranks items higher the more you pick them for a certain input. To follow trends and have new commands have achance to get to the top fairly quick, it doesn't keep the execution history forever but normalizes it from time to time. See src/exec-graph.ts for the implementation of this.
FAQs
This is the machine and inner core of the Actus command bar.
The npm package @actus/core receives a total of 5 weekly downloads. As such, @actus/core popularity was classified as not popular.
We found that @actus/core demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.