
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
@citation-js/create-plugin
Advanced tools
Template for Citation.js plugins
mkdir your-plugin
cd your-plugin
npm init @citation-js/plugin
# or 'npx @citation-js/create-plugin'
This triggers a few questions:
0.0.0
, then you can run npm version major
, minor
or patch
when the first version is readycitation-js
and the format the plugin is for<email>
and/or (website)
pubmed
for PubMed and PubMed Central IdentifiersThis generates a file structure:
.
├── .gitignore
├── .travis.yml # Configuration for my CI of choice, Travis CI
├── babel.config.js # Configuration for the Babel build tool
├── package.json # package manifest for npm/Node
├── README.md
├── src
│ ├── config.js # Defines default config options
│ ├── index.js # Registers the plugin
│ ├── input.js # Defines input formats
│ └── output.js # Defines output formats
└── test
└── suite.js # test suite
Now, run:
npm install
This installs the necessary development tools.
index.js
.index.js
and input.js
.input.js
contains an example format with an identifier that gets parsed into an API URL, the result of whichnpm run lint
and simple style issues can be corrected with npm run lint -- --fix
const core = require('@citation-js/core') // Get Citation.js
require('@babel/register') // Make sure you can use modern features
require('./src/') // Load the plugin you are working on
// If you are using synchronous functions
const data = core.Cite(input, options)
// ...
// If you are using asynchronous functions
core.Cite.async(input, options)
.then(data => /* ... */)
.catch(console.error)
test/suite.js
, which includes commentsFAQs
Template for Citation.js plugins
We found that @citation-js/create-plugin demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.