
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
@alexlafroscia/ember-unused-component-detector
Advanced tools
Locate Ember components that are not actually used in your application
A little script for finding unused components in your Ember application
In a large, long-standing codebase, it can be hard to keep track of whether all components are actually used. It's easy to stop using a component and forget to remove it, and because Ember does not do tree-shaking yet, those components will end up in your build output regardless of whether they're used or not.
This script can help suss out these unused components by
app directory to find all your component namescomponent helperEach found component will be reported in the first found style, and a warning printed if the component cannot be found.
component helper cannot be foundapp/components and app/templates/components directories are not verified; if the file exists at all it is assumed it is a component!app directory of is searched, so avoid false-positives form your tests; if the test is the only place it's used, it should be removed!This tool is best run through npx/yarn dlx
# It's assumed that the current directory is your Ember app if a path is not provided
yarn dlx @alexlafroscia/ember-unused-component-detector ./optional-path-to-project
If you want more information about what is going on under-the-hood, you can set the DEBUG=eucd:* environment variable before running the script.
Yarn 2 is used for this package; if you have any yarn installation on your computer, you'll be good-to-go!
Run husky install after cloning for linting-on-commit!
FAQs
Locate Ember components that are not actually used in your application
We found that @alexlafroscia/ember-unused-component-detector demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.