
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
@bufbuild/cel-spec
Advanced tools
This package provides CEL definitions and test data from https://github.com/google/cel-spec v0.24.0.
CEL uses Protocol Buffer definitions for parsed expressions. For example, the
message cel.expr.ParsedExpr provides an abstract representation of a parsed
CEL expression. The message types and schemas can be imported from
@bufbuild/cel-spec:
import { ParsedExpr } from "@bufbuild/cel-spec/cel/expr/syntax_pb.js";
CEL's conformance test suite also uses Protocol Buffers to define test cases.
All messages from the cel.expr.conformance namespace are exported from this
package as well, and the function getSimpleTestFiles provides conformance test data:
import { getSimpleTestFiles } from "@bufbuild/cel-spec/testdata/simple.js";
import { getTestRegistry } from "@bufbuild/cel-spec/testdata/registry.js";
import type { SimpleTestFile } from "@bufbuild/cel-spec/cel/expr/conformance/test/simple_pb.js";
const files: SimpleTestFile[] = getSimpleTestFiles();
In addition to CEL's conformance test data, this package also exports parser tests extracted from github.com/google/cel-go:
import { parserTests } from "@bufbuild/cel-spec/testdata/parser.js";
import { parserTests as parserComprehensionsTests } from "@bufbuild/cel-spec/testdata/parser-comprehensions.js";
FAQs
CEL definitions and test data
The npm package @bufbuild/cel-spec receives a total of 36,076 weekly downloads. As such, @bufbuild/cel-spec popularity was classified as popular.
We found that @bufbuild/cel-spec demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.