
Security News
Another Round of TEA Protocol Spam Floods npm, But It’s Not a Worm
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.
@bycedric/snack-eslint-standalone-test
Advanced tools
Standalone version of ESLint used in the Snack Website. This version of ESLint is bundled with the @babel/eslint-parser and various rules. It's optimized to run inside the browser.
Note, this package is decoupled from the yarn workspaces to prevent possible multiple babel versions being bundled.
yarn add @snack/eslint-standalone
import type { LintMessage } from '@snack/eslint-standalone';
import { linter, defaultConfig } from '@snack/eslint-standalone';
const code = `
function App() {
return (
<View>
<Text>Hello!</Text>
</View>
);
}
`;
const result: LintMessage[] = linter.verify(code, defaultConfig);
Because both eslint and @babel/eslint-parser weren't built to run inside the browser, we have to do a few tricks to make this work.
Babel is a huge library and runs mostly outside the browsers. To make the presets and plugins we need actually work, we need to bundle them with the babel parser. This is done by swapping out @babel/core with @snack/babel-standalone/eslint.
Because we need to run Babel inside the Snack Runtime, we already have a standalone version of Babel. In the webpack config, we swap out the @babel/core references with @snack/babel-standalone/eslint. The ESLint entrypoint is specifically made for this package, and should not be used inside the Runtime. Learn more
This plugin tries to resolve the React version from local files. It does that using some Node tooling. Because this isn't available in the browser, we patched the version detection to always return 999.999.999 (the default version). This avoids including modules, like fs or resolve, in the ESLint bundle.
FAQs
ESLint for Snack Website
We found that @bycedric/snack-eslint-standalone-test demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.

Security News
PyPI adds Trusted Publishing support for GitLab Self-Managed as adoption reaches 25% of uploads

Research
/Security News
A malicious Chrome extension posing as an Ethereum wallet steals seed phrases by encoding them into Sui transactions, enabling full wallet takeover.