Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@ebay/retriever
Advanced tools
retriever
is a small utility library for retrieving nested data safely. It contains several improvements over solutions like lodash.get
, such as:
npm install @ebay/retriever --save
var r = require('@ebay/retriever');
// set optional logger for missing data or type mismatch with defaultValue
r.setLogger({
warn: function (messageFormat, eventType, lookupPath, defaultValue) {} // used with need()
});
// sample data where content is not guaranteed
var input = {
model: {
action: {
url: 'https://www.ebay.com/sch/iphone'
textSpans: [
{
text: 'Search for iphone on eBay'
}
]
},
list: [1, 2, 3],
count: 20,
disabled: true
}
};
// cache parent when accessing multiple children
var action = r.need(input, 'model.action', {}); // input.model.action (from object)
// assumed defaultValue is empty string if none is provided
var text = r.need(action, 'textSpans[0].text'); // 'Search for iphone on eBay' (from object)
// {} is transformed to contain helper property when used as default
var content = r.need(action, 'model.content', {}); // {__isEmpty: true} (from defaultValue)
// use has() when presence is needed, but not the actual data
var hasContent = r.has(input, 'model.content'); // false
// type of defaultValue must match type of data, otherwise will log
var count = r.need(input, 'model.count', 50); // 20 (from object)
var count = r.need(input, 'model.count', '50'); // '50' (from defaultValue), logs `warning`
var count = r.get(input, 'model.count', '50'); // '50' (from defaultValue), does not log
// defaults to defaultValue when data is missing or of mismatched type
var list = r.need(input, 'model.missingProperty', []); // [] (from defaultValue)
var list = r.need(input, 'model.list'); // '' (from default defaultValue)
var list = r.need(input, 'model.list', ''); // '' (from defaultValue)
var list = r.need(input, 'model.list', {}); // {__isEmpty: true} (from defaultValue)
var list = r.need(input, 'model.list', 0); // 0 (from defaultValue)
var list = r.need(input, 'model.list', false); // false (from defaultValue)
var list = r.need(input, 'model.list', []); // [1, 2, 3] (from object)
// use get() if logging isn't necessary
var disabled = r.get(input, 'model.disabled', false); // true (from object)
var enabled = r.get(input, 'model.enabled', false); // false (from defaultValue)
var enabled = r.get(input, 'model.enabled', true); // true (from defaultValue)
need(object, path, [defaultValue])
get(object, path, [defaultValue])
Gets the value at path of object. Uses Lodash's get method. If the resolved value is undefined
or if there is a type mismatch between the resolved value and default value, the defaultValue
is returned in its place. If the defaultValue
is an empty object, an object with an internal helper __isEmpty
property is returned in its place. A type mismatch is determined with strict type checking that differentiates between object
, array
, and null
. This is opposed to the native typeof
which treats those identically as being type object
.
need()
assumes that the data of the specified type needs to be present. Otherwise, it will log a warning.
get()
is more lenient, and will not log a warning.
Arguments
object
(Object): The object to query.path
(Array | String): The path of the property to get.[defaultValue]
(*): The value returned for undefined resolved values. (defaults to '')Returns
(*): Returns the resolved value.
has(object, path)
Checks if path is a direct property of object, and has a value that is not null or undefined.
Arguments
object
(Object): The object to query.path
(Array | String): The path of the check.Returns
(boolean): Returns true
if path exists, else false
.
setLogger(logger)
Sets the logger to be used for logging any issues in retrieving the data. If logging is desired, this should be called once at the start of the app to be used for all subsequent usage. If retriever
logging is desired on the client, setLogger
must be initialized in the browser as well. If you are using this with other logging libraries, you'll need to ensure that the logging is enabled per those environment settings.
Arguments
logger
(Object): A logger object containing the function warn
. This function will be called with the following parameters:
messageFormat
, eventType
, lookupPath
, defaultValue
.For example, a type mismatch warning, the parameters might look like this:
messageFormat
: 'event: %s, path: %s, default: %s'
eventType
: 'typeMismatch'
lookupPath
: 'data.path[0]'
default
: ''
FAQs
retrieve nested data safely
The npm package @ebay/retriever receives a total of 7 weekly downloads. As such, @ebay/retriever popularity was classified as not popular.
We found that @ebay/retriever demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 10 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.