
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
@asilvas/promise-flatten
Advanced tools
Promise.prototype.flatten
functionThis proposal is stage 0 in the TC39 Process.
https://twitter.com/DavidWells/status/1119729914876284928
While try -> catch
works well, it introduces a lot of noise into software that can be avoided.
Consider:
async function test(promise1, promise2, promise3) {
let val1, val2, val3;
try {
val1 = await promise1;
} catch (ex) {
// ignore exceptions
}
try {
[val2, val3] = await Promise.all([promise2, promise3]);
} catch (ex) {
throw ex; // throw to caller
}
return val1 + val2 + val3;
}
Above contains a fair amount of boilerplate for a relatively simple logic flow. Now let's look at
an alternative using flatten
:
async function test(promise1, promise2, promise3) {
const [, val1] = await promise1.flatten(); // ignore exceptions
const [err, [val2, val3] = []] = await Promise.all([promise2, promise3]).flatten();
if (err) throw err; // throw to caller
return val1 + val2 + val3;
}
Under the covers both examples accomplish the same, but flatten
can reduce code footprint and increase readability.
function flatten() {
return this.then(ret => [undefined, ret]).catch(err => [err, undefined]);
}
Doesn't get much simpler than this. Tests included.
FAQs
TC39 Proposal for `Promise.prototype.flatten` function
The npm package @asilvas/promise-flatten receives a total of 0 weekly downloads. As such, @asilvas/promise-flatten popularity was classified as not popular.
We found that @asilvas/promise-flatten demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.