
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
@e18e/web-features-codemods
Advanced tools
This project contains a collection of codemods for transforming code to make use of newer web features and syntax.
For example, converting from array[array.length - 1] to array.at(-1).
You can install the codemods using npm or yarn:
npm install @e18e/web-features-codemods --save-dev
| Codemod | Description | Example |
|---|---|---|
arrayAt | Convert array length-based indexing to at() method | array[array.length - 1] → array.at(-1) |
arrayFill | Optimize array fill patterns | Various fill pattern optimizations |
arrayIncludes | Convert indexOf checks to includes() | array.indexOf(item) !== -1 → array.includes(item) |
arrayToReversed | Convert copy-and-reverse patterns to toReversed() | array.slice().reverse() → array.toReversed() |
arrayToSorted | Convert copy-and-sort patterns to toSorted() | array.slice().sort() → array.toSorted() |
arrayToSpliced | Convert copy-and-splice patterns to toSpliced() | const copy = arr.slice(); copy.splice(0, 1); → const copy = arr.toSpliced(0, 1); |
exponentiation | Convert Math.pow() to exponentiation operator | Math.pow(base, exp) → base ** exp |
nullishCoalescing | Convert null/undefined checks to nullish coalescing | value != null ? value : default → value ?? default |
objectHasOwn | Convert hasOwnProperty to Object.hasOwn() | obj.hasOwnProperty(prop) → Object.hasOwn(obj, prop) |
postcssSignFunctions | Remove imports for postcss-sign-functions polyfill | Removes obsolete polyfill imports |
spreadSyntax | Convert array/object methods to spread syntax | array.concat(other) → [...array, ...other] |
stringIncludes | Convert indexOf checks to includes() | string.indexOf(substr) !== -1 → string.includes(substr) |
urlCanParse | Convert URL validation try-catch to URL.canParse() | try { new URL(url) } catch { } → URL.canParse(url) |
Each codemod can be imported and used programmatically. All codemods implement the same interface with test() and apply() methods.
import {arrayAt} from '@e18e/web-features-codemods';
const sourceCode = `
const lastItem = myArray[myArray.length - 1];
const firstItem = myArray[0];
`;
// Optionally check if the codemod applies to this source.
// You can also skip this step and directly call apply() as non-matching
// codemods will simply return the original source.
if (arrayAt.test({source: sourceCode})) {
// Apply the transformation
const transformed = arrayAt.apply({source: sourceCode});
console.log(transformed);
// Output:
// const lastItem = myArray.at(-1);
// const firstItem = myArray[0];
}
MIT
FAQs
A collection of codemods for web features
The npm package @e18e/web-features-codemods receives a total of 5 weekly downloads. As such, @e18e/web-features-codemods popularity was classified as not popular.
We found that @e18e/web-features-codemods demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.