
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
@bangjelkoski/node-stdlib-browser
Advanced tools
Node standard library for browser.
Features:
node-libs-browser
for Webpacknode: protocol which
allows for builtin modules to be referenced by valid absolute URL stringsCheck example to see how modules work in browser environment.
npm install node-stdlib-browser --save-dev
As of Webpack 5, aliases and globals provider need to be explicitly configured.
If you want to handle node: protocol imports, you
need to provide helper plugin.
// webpack.config.js
const stdLibBrowser = require('node-stdlib-browser');
const {
NodeProtocolUrlPlugin
} = require('node-stdlib-browser/helpers/webpack/plugin');
const webpack = require('webpack');
module.exports = {
// ...
resolve: {
alias: stdLibBrowser
},
plugins: [
new NodeProtocolUrlPlugin(),
new webpack.ProvidePlugin({
process: stdLibBrowser.process,
Buffer: [stdLibBrowser.buffer, 'Buffer']
})
]
};
If you’re using ESM config, additional configuration is needed to handle unspecified extensions:
// webpack.config.js
module.exports = {
// ...
module: {
rules: [
{
test: /\.m?js$/,
resolve: {
fullySpecified: false
}
}
]
}
};
Since many packages expose only CommonJS implementation, you need to apply plugins to handle CommonJS exports. Those packages could have dependencies installed with npm so they need to be properly resolved (taking into account browser-specific implementations).
Some dependencies can have circular dependencies and Rollup will warn you about that. You can ignore these warnings with helper function (reference).
// rollup.config.js
const stdLibBrowser = require('node-stdlib-browser');
const {
handleCircularDependancyWarning
} = require('node-stdlib-browser/helpers/rollup/plugin');
const { default: resolve } = require('@rollup/plugin-node-resolve');
const commonjs = require('@rollup/plugin-commonjs');
const json = require('@rollup/plugin-json');
const alias = require('@rollup/plugin-alias');
const inject = require('@rollup/plugin-inject');
module.exports = {
// ...
plugins: [
alias({
entries: stdLibBrowser
}),
resolve({
browser: true
}),
commonjs(),
json(),
inject({
process: stdLibBrowser.process,
Buffer: [stdLibBrowser.buffer, 'Buffer']
})
],
onwarn: (warning, rollupWarn) => {
handleCircularDependancyWarning(warning, rollupWarn);
}
};
Vite config uses combination of Rollup and esbuild plugins. node:
protocol imports are currently not supported
(issue).
const inject = require('@rollup/plugin-inject');
module.exports = async () => {
const { default: stdLibBrowser } = await import('node-stdlib-browser');
return {
resolve: {
alias: stdLibBrowser
},
optimizeDeps: {
include: ['buffer', 'process']
},
plugins: [
{
...inject({
global: [
require.resolve(
'node-stdlib-browser/helpers/esbuild/shim'
),
'global'
],
process: [
require.resolve(
'node-stdlib-browser/helpers/esbuild/shim'
),
'process'
],
Buffer: [
require.resolve(
'node-stdlib-browser/helpers/esbuild/shim'
),
'Buffer'
]
}),
enforce: 'post'
}
]
};
};
Using esbuild requires you to use helper utilities and plugins.
const path = require('path');
const esbuild = require('esbuild');
const plugin = require('node-stdlib-browser/helpers/esbuild/plugin');
const stdLibBrowser = require('node-stdlib-browser');
(async () => {
await esbuild.build({
// ...
inject: [require.resolve('node-stdlib-browser/helpers/esbuild/shim')],
define: {
global: 'global',
process: 'process',
Buffer: 'Buffer'
},
plugins: [plugin(stdLibBrowser)]
});
})();
Bundling ES modules is currently not supported natively in Browserify, but you can try using esmify or babelify for transforming to CommonJS first.
const fs = require('fs');
const path = require('path');
const browserify = require('browserify');
const aliasify = require('aliasify');
const stdLibBrowser = require('node-stdlib-browser');
const b = browserify(
[
/* ... */
],
{
// ...
transform: [[aliasify, { aliases: stdLibBrowser }]],
insertGlobalVars: {
process: () => {
return `require('${stdLibBrowser.process}')`;
},
Buffer: () => {
return `require('${stdLibBrowser.buffer}').Buffer`;
}
}
}
);
| Module | Browser implementation | Mock implementation | Notes |
|---|---|---|---|
assert | assert | ||
buffer | buffer | buffer | buffer@5 for IE 11 support |
child_process | |||
cluster | |||
console | console-browserify | console | |
constants | constants-browserify | ||
crypto | crypto-browserify | ||
dgram | |||
dns | dns | ||
domain | domain-browser | ||
events | events | ||
fs | Mocking fs | ||
http | stream-http | ||
https | https-browserify | ||
module | |||
net | net | ||
os | os-browserify | ||
path | path-browserify | ||
process | process | process | |
punycode | punycode | punycode@1 for browser support | |
querystring | querystring-es3 | Contains additional exports from newer Node versions | |
readline | |||
repl | |||
stream | stream-browserify | ||
string_decoder | string_decoder | ||
sys | util | ||
timers | timers-browserify | ||
timers/promises | isomorphic-timers-promises | ||
tls | tls | ||
tty | tty-browserify | tty | |
url | node-url | Contains additional exports from newer Node versions (URL and URLSearchParams are not polyfilled) | |
util | util | ||
vm | vm-browserify | ||
zlib | browserify-zlib | ||
_stream_duplex | readable-stream | ||
_stream_passthrough | readable-stream | ||
_stream_readable | readable-stream | ||
_stream_transform | readable-stream | ||
_stream_writable | readable-stream |
Returns: object
Exports absolute paths to each module directory (where package.json is
located), keyed by module names. Modules without browser replacements return
module with default export null.
Some modules have mocks in the mock directory. These are replacements with minimal functionality.
fsfs package doesn’t return anything since there are many different ways you can
implement file system functionality in browser.
Examples of implementations:
Minimum supported version should be Node 10.
If you’re using ESM in Node < 12.20, note that subpath patterns are not supported so mocks can’t be handled. In that case, it’s recommended to use CommonJS implementation.
Minimum supported version should be Internet Explorer 11, but most modules support even Internet Explorer 9.
You can use default @types/node types.
MIT © Ivan Nikolić
FAQs
Node standard library for browser.
The npm package @bangjelkoski/node-stdlib-browser receives a total of 266 weekly downloads. As such, @bangjelkoski/node-stdlib-browser popularity was classified as not popular.
We found that @bangjelkoski/node-stdlib-browser demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.