
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
@esbuild/android-arm
Advanced tools
This is a WebAssembly shim for esbuild on Android ARM. See https://github.com/evanw/esbuild for details.
0.25.10
Fix a panic in a minification edge case (#4287)
This release fixes a panic due to a null pointer that could happen when esbuild inlines a doubly-nested identity function and the final result is empty. It was fixed by emitting the value undefined
in this case, which avoids the panic. This case must be rare since it hasn't come up until now. Here is an example of code that previously triggered the panic (which only happened when minifying):
function identity(x) { return x }
identity({ y: identity(123) })
Fix @supports
nested inside pseudo-element (#4265)
When transforming nested CSS to non-nested CSS, esbuild is supposed to filter out pseudo-elements such as ::placeholder
for correctness. The CSS nesting specification says the following:
The nesting selector cannot represent pseudo-elements (identical to the behavior of the ':is()' pseudo-class). We’d like to relax this restriction, but need to do so simultaneously for both ':is()' and '&', since they’re intentionally built on the same underlying mechanisms.
However, it seems like this behavior is different for nested at-rules such as @supports
, which do work with pseudo-elements. So this release modifies esbuild's behavior to now take that into account:
/* Original code */
::placeholder {
color: red;
body & { color: green }
@supports (color: blue) { color: blue }
}
/* Old output (with --supported:nesting=false) */
::placeholder {
color: red;
}
body :is() {
color: green;
}
@supports (color: blue) {
{
color: blue;
}
}
/* New output (with --supported:nesting=false) */
::placeholder {
color: red;
}
body :is() {
color: green;
}
@supports (color: blue) {
::placeholder {
color: blue;
}
}
FAQs
A WebAssembly shim for esbuild on Android ARM.
The npm package @esbuild/android-arm receives a total of 6,069,080 weekly downloads. As such, @esbuild/android-arm popularity was classified as popular.
We found that @esbuild/android-arm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.