Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
@hapi/ammo is a utility library for HTTP payload processing, specifically designed to handle HTTP payload ranges. It is part of the hapi ecosystem and is used to parse and validate HTTP Range headers, which are often used for partial content delivery.
Range Parsing
This feature allows you to parse the 'Range' HTTP header and determine the byte ranges requested by the client. The `Ammo.header` function takes the range header and the total length of the resource, returning an array of ranges.
const Ammo = require('@hapi/ammo');
const rangeHeader = 'bytes=0-4,9-15';
const length = 20;
const ranges = Ammo.header(rangeHeader, length);
console.log(ranges);
Range Validation
This feature validates the parsed ranges to ensure they are within the bounds of the resource length. If the ranges are valid, it returns an array of ranges; otherwise, it returns null.
const Ammo = require('@hapi/ammo');
const rangeHeader = 'bytes=0-4,9-15';
const length = 20;
const ranges = Ammo.header(rangeHeader, length);
if (ranges) {
console.log('Valid ranges:', ranges);
} else {
console.log('Invalid range header');
}
The 'range-parser' package is a utility for parsing HTTP Range headers. It provides similar functionality to @hapi/ammo by parsing range headers and returning the requested ranges. However, it is a more lightweight and standalone package compared to @hapi/ammo, which is part of the larger hapi ecosystem.
ammo is part of the hapi ecosystem and was designed to work seamlessly with the hapi web framework and its other components (but works great on its own or with other frameworks). If you are using a different web framework and find this module useful, check out hapi – they work even better together.
FAQs
HTTP Range processing utilities
We found that @hapi/ammo demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.