Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@alibsp/dinamic
Advanced tools
DinamicX 是基于模版的动态化技术,通过模版与页面代码的分离,使页面获得了布局、样式、事件、数据等几部分的动态输入的能力。
它主要包含如下几个特点:
DinamicX H5 SDK 作为三端技术中的一部分,实现了Native支持的所有基础功能,包括事件处理、表达式解析、模版管理、页面渲染等;实现了从XML模版到 JSON tree中间态的模版预处理,以及在运行时由中间态到虚拟DOM的转化;SDK本身不承载UI渲染能力,虚拟DOM的产出和实际DOM的渲染交给依赖的渲染引擎完成;渲染引擎并不严格限定,理论 React-style UI库均可支持,目前测试过的包括React, Preact以及Rax,渲染引擎的转化可以通过构建时完成,无需任何代码改动;
import * as Dinamic from '@ali/dinamic';
import '@ali/dinamic-views';
const url = xx;
const data = xx;
const {Template, Fragment} = Dinamic;
Dinamic.render((
<Fragment>
<Template url={url} data={data}></Template>
<Template url={url} data={data}></Template>
</Fragment>
), document.querySelector('#app'));
详情 API 参见:https://yuque.antfin-inc.com/dinamicx/dfzn4i/hpfs05
请 Follow 如下规范去构建开发环境和提交代码
npm install -g tnpm --registry=http://registry.npm.alibaba-inc.com
tnpm install -g simplepack
tnpm i -g @ali/def
def --version
,正常返回版本信息,表示安装成功def login
完成用户登录注册前面工具安装完成后, 克隆项目到本地目录,然后在项目根目录完成如下步骤:
安装依赖
tnpm install
启动调试服务器
def dev
所有主要功能开发,都需要自测后,调整或补充对应测试用例,并且执行 tnpm test
pass 所有用例
参考新人手册: http://handbook.labs.taobao.net/
{Developer Name}/x.y.z
eg. jelly/0.0.1
版本号需按照当前master版本号,patch 位置(末尾位)加一来确定;
最终核心包发布版本号,会在PR合并主干之后,再确定
参考并简化 Google AngularJS 代码贡献规范
<!-- 简短格式 -->
<type>: <subject>
<!-- 完整格式 -->
<type>: <subject>
<BLANK LINE>
<body>
<BLANK LINE>
<footer>
具体形式如下:
改动内容的简明描述
FAQs
dinamic for web
The npm package @alibsp/dinamic receives a total of 0 weekly downloads. As such, @alibsp/dinamic popularity was classified as not popular.
We found that @alibsp/dinamic demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.