
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
@exodus/asset-icons
Advanced tools
Package exports functions to generate asset-icons.
The functions are assumed to be used within platform's scripts and rely on assets-base
package to get list of -meta
packages to get svg from.
yarn add -D @exodus/asset-icons
generate.web.js
- exports function to build a file exporting assetIcons
dict in the form of {[assetName]: RawSvgReference}
. Used in web environments.
get-asset-icon-path-items.js
- exports function returning array of paths to svg files from -meta
packages. May be used as an input for svgr.
Both scripts use 3 positional process parameters:
relativeOutputDir
- where to put generated files
relativeNodeModulesDir
- path to noode_modules
containing assets-base
package
yarnLockPath
- path to the yarn.lock
file relative to node_modules
Example of the asset-icons.js
script in web platform:
const generate = require('@exodus/asset-icons/scripts/generate.web')
generate()
generate({ yarnLockPath: '../yarn.lock' }) // to generate based on the yarn.lock dependencie rather than assets-base
And its usage:
#!/bin/sh
NODE_MODULES_DIR="./src/node_modules"
SCRIPT_PATH="./scripts/asset-icons.js"
OUT_DIR="./src/_local_modules/asset-icons"
OUT_DIR_FILES="${OUT_DIR}/*.js"
node "${SCRIPT_PATH}" "${OUT_DIR}" "${NODE_MODULES_DIR}" &&
prettier --write "${OUT_DIR_FILES}" &&
eslint "${OUT_DIR_FILES}" --fix
FAQs
Exodus assets icons generator helpers
The npm package @exodus/asset-icons receives a total of 1,314 weekly downloads. As such, @exodus/asset-icons popularity was classified as popular.
We found that @exodus/asset-icons demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 109 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.