
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@black-flag/demo
Advanced tools
$ npx -p @black-flag/demo myctl --help
Black Flag is a yargs-based library for creating deeply hierarchical CLI tools declaratively and simply.
This repository corresponds to the usage tutorial featured in the Black Flag documentation.
You don't need to install this demo to use it. You can invoke it directly:
npx -p @black-flag/demo myctl init --lang node --version=22.12
If you do want to install the CLI for some reason, you should install it globally:
npm install -g @black-flag/demo
You can use the --help
option to determine what the demo CLI can do:
npx -p @black-flag/demo myctl --help
And see pretty debug insights like so:
DEBUG='*' npx -p @black-flag/demo myctl init --lang node --version=22.12
This is an ESM-only package built by Babel for use in Node.js
versions that are not end-of-life. For TypeScript users, this package supports
both "Node10"
and "Node16"
module resolution strategies.
That means ESM source will load this package via import { ... } from ...
or
await import(...)
and CJS source will load this package via dynamic
import()
. This has several benefits, the foremost being: less code
shipped/smaller package size, avoiding dual package
hazard entirely, distributables are not
packed/bundled/uglified, and a drastically less complex build process.
The glaring downside, which may or may not be relevant, is that CJS consumers
cannot require()
this package and can only use import()
in an asynchronous
context. This means, in effect, CJS consumers may not be able to use this
package at all.
Each entry point (i.e. ENTRY
) in package.json
's
exports[ENTRY]
object includes one or more export
conditions. These entries may or may not include: an
exports[ENTRY].types
condition pointing to a type
declaration file for TypeScript and IDEs, a
exports[ENTRY].module
condition pointing to
(usually ESM) source for Webpack/Rollup, a exports[ENTRY].node
and/or
exports[ENTRY].default
condition pointing to (usually CJS2) source for Node.js
require
/import
and for browsers and other environments, and other
conditions not enumerated here. Check the
package.json file to see which export conditions are
supported.
Note that, regardless of the { "type": "..." }
specified in
package.json
, any JavaScript files written in ESM
syntax (including distributables) will always have the .mjs
extension. Note
also that package.json
may include the
sideEffects
key, which is almost always false
for
optimal tree shaking where appropriate.
See LICENSE.
New issues and pull requests are always welcome and greatly appreciated! 🤩 Just as well, you can star 🌟 this project to let me know you found it useful! ✊🏿 Or buy me a beer, I'd appreciate it. Thank you!
See CONTRIBUTING.md and SUPPORT.md for more information.
Thanks goes to these wonderful people (emoji key):
Bernard 🚇 💻 📖 🚧 ⚠️ 👀 |
|
This project follows the all-contributors specification. Contributions of any kind welcome!
@black-flag/demo[@1.2.0][3] (2025-03-25)
FAQs
<!-- symbiote-template-region-start 1 -->
We found that @black-flag/demo demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.