Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
@bonniernews/local-esi
Advanced tools
Make your Express app work like it had Akamai Edge Side Includes parsing or just stream your ESI decorated markup to the parser.
ESI
: transform class that returns an ESI transform streamHTMLWriter
: transform class that returns markup from object streamparse
: async function that returns ESI evaluated markupnew ESI([options])
Create an ESI transform stream. Emits events.
Arguments:
options
: optional options object with headers and cookies
headers
: request headers, accessible through ESI globals HTTP_<HEADER_NAME>
, x-forwarded-for
will be accessible as REMOTE_ADDR
x-localesi-geo
: headers to simulate Akamai's geo location abilities. Defaults to: country_code=SE,georegion=208
. Accessible through ESI global GEO{}
cookies
: object with request cookies, accessible through ESI global HTTP_COOKIE
path
: string request path, mapped to ESI global REQUEST_PATH
query
: object request query parameters, accessible through ESI global QUERY_STRING
localhost
: host to use when a relative src is used by eval or include, defaults to headers.host
Returns:
Example express route:
"use strict";
const HTMLParser = require("@bonniernews/atlas-html-stream");
const {ESI, HTMLWriter} = require("@bonniernews/local-esi");
const {pipeline} = require("stream");
module.exports = function streamRender(req, res, next) {
const { headers, cookies, path, query } = req;
const options = {
headers,
cookies,
path,
query,
localhost: `localhost:${req.socket.server.address().port}`,
};
const esi = new ESI(options)
.once("set_redirect", function onSetRedirect(statusCode, location) {
res.status(statusCode).redirect(location);
this.destroy();
})
.on("set_response_code", function onSetResponseCode(statusCode, body) {
res.status(statusCode);
if (!body) return;
res.send(body);
this.destroy();
})
.on("add_header", (name, value) => {
res.set(name, value);
});
const body = "";
pipeline([
res.render("index"),
new HTMLParser({preserveWS: true}),
esi,
new HTMLWriter(),
], (err) => {
if (err?.code === "ERR_STREAM_PREMATURE_CLOSE"]) {
return;
} else if (err) {
return next(err);
}
return res.send(body);
}).on("data", (chunk) => {
body += chunk;
});
};
parse(html, options)
Arguments:
html
: markup to parseoptions
: same as for for ESIReturns promise:
body
: string with ESI evaluated markup or body from $set_response_code
statusCode
: occasional status code from $set_response_code
or $set_redirect
headers
: object with added headers (in lowercase) from $add_header
or $set_redirect(location)
, NB! set-cookie
will be in a listExample express route:
"use strict";
const {parse} = require("@bonniernews/local-esi");
module.exports = function render(req, res, next) {
const { headers, cookies, path, query } = req;
const options = {
headers,
cookies,
path,
query,
localhost: `localhost:${req.socket.server.address().port}`,
};
const html = res.render("index");
const {statusCode, headers, body} = await parse(html, options);
if (statusCode < 309 && statusCode > 300) {
return res.redirect(statusCode, headers.location);
}
if (statusCode) {
res.status(statusCode);
} else if (!res.statusCode) {
res.status(200);
}
return res.send(body);
};
new HTMLWriter()
Returns transform object stream to markup buffer stream.
ESI instructions are emitted as events.
set_response_code
Parser encountered a $set_response_code
instruction with status code and optional body.
Signature:
statusCode
: number HTTP status codebody
: optional string bodyadd_header
Parser encountered a $add_header
instruction with HTTP header name and value.
Signature:
name
: HTTP header namevalue
: HTTP header valueset_redirect
Parser encountered a $set_redirect
instruction with optional status code and location.
Signature:
statusCode
: redirect HTTP status codelocation
: redirect locationObject streams requires the schema {name, data, text}
representing tag name, tag attributes, and text. This project uses @bonniernews/atlas-html-stream for html parsing.
FAQs
Local Edge Side Includes parser
The npm package @bonniernews/local-esi receives a total of 20 weekly downloads. As such, @bonniernews/local-esi popularity was classified as not popular.
We found that @bonniernews/local-esi demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 27 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.