Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@cplace/cli
Advanced tools
The objective of this project is to demonstrate how a Typescript project can be used to build an NPM module that can be published to the NPM registry so that it can be used from other Typescript projects without the need to install additional typings.
The objective of this project is to demonstrate how a Typescript project can be used to build an NPM module that can be published to the NPM registry so that it can be used from other Typescript projects without the need to install additional typings.
This project needs Typescript, to install Typescript:
npm install -g typescript
The project also used Gulp:
npm install -g gulp
TSLint is also required:
npm install -g tslint
Mocha:
npm install -g mocha
Typings:
npm install -g typings
After cloning this project and ensuring global dependencies are installed, execute:
npm install
typings install
This will install all the dev dependencies of the project.
To build the project from Visual Studio Code, Press Cmd + Shift + B
(or Control + Shift + B
on Windows). This will build the project and execute the test cases.
To debug the project from Visual Studio Code, set a break point in a Mocha spec file, then Press Cmd + Shift + D
(or Control + Shift + D
on Windows). Then select "Run mocha" from the debug menu and start debugging. This will hit your breakpoint and stop.
To build the project:
gulp pack
The above command will generate a package file that is ready to be consumed by another Typescript project.
npm pack
to this new directorycd ~
mkdir moduletest
cd moduletest
cp ../tsc-seed/tsc-seed-1.0.0.tgz .
$ npm init
This utility will walk you through creating a package.json file.
It only covers the most common items, and tries to guess sensible defaults.
See `npm help json` for definitive documentation on these fields
and exactly what they do.
Use `npm install <pkg> --save` afterwards to install a package and
save it as a dependency in the package.json file.
Press ^C at any time to quit.
name: (moduletest)
version: (1.0.0)
description:
entry point: (index.js)
test command:
git repository:
keywords:
author:
license: (ISC)
About to write to /Users/nocturne/moduletest/package.json:
{
"name": "moduletest",
"version": "1.0.0",
"description": "",
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"author": "",
"license": "ISC"
}
Is this ok? (yes)
$ tsc --init
$ npm install tsc-seed-1.0.0.tgz
Now, the module can be used from a new file. Create a file called index.ts in Visual Studio Code:
import * as MyModule from "tsc-seed";
const calculator = new MyModule.Arithmetic.Calculator();
console.log(calculator.add(1, 2));
$ tsc
$ node index.js
The output should be:
3
FAQs
cplace cli tools
The npm package @cplace/cli receives a total of 4,620 weekly downloads. As such, @cplace/cli popularity was classified as popular.
We found that @cplace/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.