
Research
/Security News
TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack
Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.
@gaubee/util
Advanced tools
@std/* 互为补充。
这个库中与 @std 系列有一些交集,交集的部分通常是我个人觉得我自己的实现更好:
- 可能是性能上更好
- 可能是使用体验上更易用好用
- 可能是条件边界覆盖更全。
install:
npm install @gaubee/util
pnpm install @gaubee/util
yarn install @gaubee/util
deno add @gaubee/util
bun add @gaubee/util
usage:
注意,本项目没有副作用了,对 Tree-Shaking 支持良好,你可以直接 import 一整个包,最终 bundle 的时候,只会包含你实际使用的部分。
import {delay} from "@gaubee/util";
@std/* 互为补充。
这个库中与 @std 系列有一些交集,交集的部分通常是我个人觉得我自己的实现更好:
- 可能是性能上更好
- 可能是使用体验上更易用好用
- 可能是条件边界覆盖更全。
例如 Promise.withResolvers
如果你的项目是 application 级别,不会被其它项目所依赖,那么我建议导入 global 系列,它能大幅度提升你的 js 开发体验。 虽然大家都说“不要污染原型链”,但是辩证看待,我建议你在合适的时候,“应该充分利用原型链”。 在原型链上扩展函数,通过链式调用,可以达到很多符合直觉的开发体验。
并且,随着 shadowrealm 提案 的演进,未来污染原型链在复杂项目里头就将不再是问题。
由于 jsr 上不允许上传污染全局的模块,所以如果需要,请使用 npm 版本。 npm 版本还包含了 commonjs 的直接支持。
abort_signal_merge:
(..._signals: (AbortSignal | undefined | null)[]) => AbortSignal | undefinedarr_set_next:
(arr: Array<T>, item: T) => voidsparse_arr_get_first:
<T>(arr: ArrayLike<T>) => Tsparse_arr_get_first_or_null:
<T>(arr: ArrayLike<T>) => T | undefinedsparse_arr_get_first_or_default:
<T, R>(arr: ArrayLike<T>, defaultValue: () => R) => T | Rarr_get_first:
<T>(arr: ArrayLike<T>) => Tarr_get_first_or_null:
<T>(arr: ArrayLike<T>) => T | undefinedarr_get_first_or_default:
<T, R>(arr: ArrayLike<T>, defaultValue: () => R) => T | Rsparse_arr_get_last:
<T>(arr: ArrayLike<T>) => Tsparse_arr_get_last_or_null:
<T>(arr: ArrayLike<T>) => T | undefinedsparse_arr_get_last_or_default:
<T, R>(arr: ArrayLike<T>, defaultValue: () => R) => T | Rarr_get_last:
<T>(arr: ArrayLike<T>) => Tarr_get_last_or_null:
<T>(arr: ArrayLike<T>) => T | undefinedarr_get_last_or_default:
<T, R>(arr: ArrayLike<T>, defaultValue: () => R) => T | Rarr_remove_first:
<T>(arr: T[], value: T) => numberbigint_gcd:
(left: bigint, right: bigint) => bigintdate_clone:
(date: Date) => DateDuration:
type Duration = { year: number; month: number; day: number; minutes: number; seconds: number; milliseconds: number; }date_add_duration:
(date: Date, duration: Partial<Duration>) => Datedate_to_duration:
(date: Date) => Durationdate_set_duration:
(date: Date, duration: Partial<Duration>) => DateFormatifyDate:
type FormatifyDate = { ... }date_formatify:
(date: string | number | Date) => FormatifyDatedate_format:
(format: string, date: string | number | Date) => stringfunc_debounce:
<T extends Func>(fn: T, wait: number | Timmer = 0, options: { before?: boolean }) => DebouncedFunction<T>isPending, cancel, source, flush 方法。DebouncedFunction: 带有额外控制方法的函数类型FAQs
一些常见的pure-js工具函数,适用于任何场景
The npm package @gaubee/util receives a total of 335 weekly downloads. As such, @gaubee/util popularity was classified as not popular.
We found that @gaubee/util demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.

Research
/Security News
Socket found 16 malicious Firefox extensions designed to steal crypto wallet recovery phrases and private keys using cloned Rabby and OKX interfaces.

Product
Socket now scans VS Code extensions, giving teams early detection of risky behaviors, hidden capabilities, and supply chain threats in developer tools.