Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@evidentpoint/readium-js
Advanced tools
EPUB core processing engine written in Javascript.
This is a software component used by the Readium Chrome extension and the "cloud reader" ( https://github.com/readium/readium-js-viewer ).
Please see https://github.com/readium/readium-shared-js for more information about the underlying rendering engine.
You can try Readium here:
BSD-3-Clause ( http://opensource.org/licenses/BSD-3-Clause )
See license.txt.
Initial setup:
git submodule update --init --recursive
to ensure that the readium-js chain of dependencies is initialised (readium-shared-js and readium-cfi-js)git checkout BRANCH_NAME && git submodule foreach --recursive "git checkout BRANCH_NAME"
to switch to the desired BRANCH_NAMEnpm run prepare:all
(to perform required preliminary tasks, like patching code before building)yarn run prepare:yarn:all
(to use Yarn instead of NPM for node_module management)Note that in some cases, administrator rights may be needed in order to install dependencies, because of NPM-related file access permissions (the console log would clearly show the error). Should this be the case, running sudo npm run prepare:all
usually solves this.
Note that the above command executes the following:
npm install
(to download dependencies defined in package.json
... note that the --production
option can be used to avoid downloading development dependencies, for example when testing only the pre-built build-output
folder contents)npm update
(to make sure that the dependency tree is up to date)Typical workflow:
No RequireJS optimization:
npm run http
(to launch an http server. This automatically opens a web browser instance to the HTML files in the dev
folder, choose index_RequireJS_no-optimize.html
, or the *LITE.html
variant which do include only the reader view, not the ebook library view)src/js
folder)Or to use optimized Javascript bundles (single or multiple):
npm run build
(to update the RequireJS bundles in the build output folder)npm run http:watch
(to launch an http server. This automatically opens a web browser instance to the HTML files in the dev
folder, choose index_RequireJS_single-bundle.html
or index_RequireJS_multiple-bundles.html
, or the *LITE.html
variants which do include only the reader view, not the ebook library view)npm run http
(same as above, but without watching for file changes (no automatic rebuild))Plugins integration:
When invoking the npm run build
command, the generated build-output
folder contains RequireJS module bundles that include the default plugins specified in readium-js-shared/plugins/plugins.cson
(see the readium-js-shared/PLUGINS.md
documentation). Developers can override the default plugins configuration by using an additional file called plugins-override.cson
. This file is git-ignored (not persistent in the Git repository), which means that Readium's default plugins configuration is never at risk of being mistakenly overridden by developers, whilst giving developers the possibility of creating custom builds on their local machines.
For example, the annotations
plugin can be activated by adding it to the include
section in readium-js-shared/plugins/plugins-override.cson
.
This way, after invoking npm run http
, the ./dev/index*.html
demo apps can be used to create / remove highlighted selections in the web browser.
All packages "owned" and maintained by the Readium Foundation are listed here: https://www.npmjs.com/~readium
Note that although Node and NPM natively use the CommonJS format, Readium modules are currently only defined as AMD (RequireJS). This explains why Browserify ( http://browserify.org ) is not used by this Readium project. More information at http://requirejs.org/docs/commonjs.html and http://requirejs.org/docs/node.html
npm install readium-js
completes successfully ( https://www.npmjs.com/package/readium-js )npm run http
, which opens a web browser to a basic RequireJS bootstrapper located in the dev
folder (this is not a fully-functioning application!)Note: the --dev
option after npm install readium-js
can be used to force the download of development dependencies,
but this is kind of pointless as the code source and RequireJS build configuration files are missing.
See below if you need to hack the code.
The build-output
directory contains common CSS styles, as well as two distinct folders:
The _single-bundle
folder contains readium-js_all.js
(and its associated source-map file, as well as a RequireJS bundle index file (which isn't actually needed at runtime, so here just as a reference)),
which aggregates all the required code (external library dependencies included, such as Underscore, jQuery, etc.),
as well as the "Almond" lightweight AMD loader ( https://github.com/jrburke/almond ).
This means that the full RequireJS library ( http://requirejs.org ) is not actually needed to bootstrap the AMD modules at runtime,
as demonstrated by the HTML file in the dev
folder (trimmed for brevity):
<html>
<head>
<!-- main code bundle, which includes its own Almond AMD loader (no need for the full RequireJS library) -->
<script type="text/javascript" src="../build-output/_single-bundle/readium-js_all.js"> </script>
<!-- index.js calls into the above library -->
<script type="text/javascript" src="./index.js"> </script>
</head>
<body>
<div id="viewport"> </div>
</body>
</html>
The _multiple-bundles
folder contains several Javascript bundles (and their respective source-map files, as well as RequireJS bundle index files):
readium-external-libs.js
: aggregated library dependencies (e.g. Underscore, jQuery, etc.)readium-shared-js.js
: shared Readium code (basically, equivalent to the js
folder of the "readium-shared-js" submodule)readium-cfi-js.js
: Readium CFI library (basically, equivalent to the js
folder of the readium-cfi-js submodule)readium-js.js
: this Readium code (see the js
folder, which includes epub-fetch and epub-model source code)readium-plugin-example.js
: simple plugin demoreadium-plugin-annotations.js
: the annotation plugin (DOM selection + highlight), which bundle actually contains the "Backbone" library, as this dependency is not already included in the "external libs" bundle.
)In addition, the folder contains the full RequireJS.js
library ( http://requirejs.org ), as the above bundles do no include the lightweight "Almond" AMD loader ( https://github.com/jrburke/almond ).
Usage is demonstrated by the HTML file in the dev
folder (trimmed for brevity):
<html>
<head>
<!-- full RequireJS library -->
<script type="text/javascript" src="../build-output/_multiple-bundles/RequireJS.js"> </script>
<!-- individual bundles: -->
<!-- readium CFI library -->
<script type="text/javascript" src="../build-output/_multiple-bundles/readium-cfi-js.js"> </script>
<!-- external libraries -->
<script type="text/javascript" src="../build-output/_multiple-bundles/readium-external-libs.js"> </script>
<!-- readium itself -->
<script type="text/javascript" src="../build-output/_multiple-bundles/readium-shared-js.js"> </script>
<!-- simple example plugin -->
<script type="text/javascript" src="../build-output/_multiple-bundles/readium-plugin-example.js"> </script>
<!-- annotations plugin -->
<script type="text/javascript" src="../build-output/_multiple-bundles/readium-plugin-annotations.js"> </script>
<!-- readium js -->
<script type="text/javascript" src="../build-output/_multiple-bundles/readium-js.js"> </script>
<!-- index.js calls into the above libraries -->
<script type="text/javascript" src="./index.js"> </script>
</head>
<body>
<div id="viewport"> </div>
</body>
</html>
Note how the "external libs" set of AMD modules can be explicitly described using the bundles
RequireJS configuration directive
(this eliminates the apparent opacity of such as large container of library dependencies):
<script type="text/javascript">
requirejs.config({
baseUrl: '../build-output/_multiple-bundles'
});
</script>
<script type="text/javascript" src="../build-output/_multiple-bundles/readium-cfi-js.js.bundles.js"> </script>
<script type="text/javascript" src="../build-output/_multiple-bundles/readium-external-libs.js.bundles.js"> </script>
<script type="text/javascript" src="../build-output/_multiple-bundles/readium-shared-js.js.bundles.js"> </script>
<script type="text/javascript" src="../build-output/_multiple-bundles/readium-plugin-example.js.bundles.js"> </script>
<script type="text/javascript" src="../build-output/_multiple-bundles/readium-plugin-annotations.js.bundles.js"> </script>
<script type="text/javascript" src="../build-output/_multiple-bundles/readium-js.js.bundles.js"> </script>
CSON = CoffeeScript-Object-Notation ( https://github.com/bevry/cson )
Running the command npm run cson2json
will re-generate the package.json
JSON file.
For more information, see comments in the master package.cson
CSON file.
Why CSON? Because it is a lot more readable than JSON, and therefore easier to maintain. The syntax is not only less verbose (separators, etc.), more importantly it allows comments and line breaking!
Although these benefits are not so critical for basic "package" definitions,
here package.cson/json
declares relatively intricate script
tasks that are used in the development workflow.
npm run SCRIPT_NAME
offers a lightweight technique to handle most build tasks,
as NPM CLI utilities are available to perform cross-platform operations (agnostic to the actual command line interface / shell).
For more complex build processes, Grunt / Gulp can be used, but these build systems do not necessarily offer the most readable / maintainable options.
Downside: DO NOT invoke npm init
or npm install --save
--save-dev
--save-optional
,
as this would overwrite / update the JSON, not the master CSON!
See separate API doc.
FAQs
Readium - core javascript module
The npm package @evidentpoint/readium-js receives a total of 0 weekly downloads. As such, @evidentpoint/readium-js popularity was classified as not popular.
We found that @evidentpoint/readium-js demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.