
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
@jiayouzuo/shared-js
Advanced tools
通用 JavaScript 工具函数库,支持 ESM / CommonJS / UMD。
npm install @jiayouzuo/shared-js
| 模块 | 说明 |
|---|---|
http | HTTP 请求封装(拦截器、重试、取消) |
timer | 定时器工具(rafTimeout、idleCallback) |
format | 格式化工具(数值、日期、中文大写金额) |
validate | 验证工具(类型判断、格式校验) |
uid | 唯一ID生成(uuid、雪花ID、时间戳ID) |
ws | WebSocket 封装(自动重连、心跳) |
safe | 安全函数(JSON、Storage、属性访问) |
worker | Web Worker 封装(内联函数、Promise 化) |
transport | WebTransport 封装(HTTP/3、双向流、数据报) |
import {
http, // HTTP 客户端
formatDate, // 日期格式化
isEmptyValue, // 空值判断
uuid, // UUID 生成
safeLocalStorage, // 安全 localStorage
createWebSocket, // WebSocket 客户端
runInWorker // Worker 执行
} from '@jiayouzuo/shared-js'
// HTTP 请求
const users = await http.get('/api/users')
// 日期格式化
formatDate(new Date(), 'YYYY-MM-DD HH:mm:ss')
// 空值判断
isEmptyValue(null) // true
isEmptyValue('') // true
isEmptyValue([]) // true
// UUID
uuid() // 'a1b2c3d4-e5f6-7890-abcd-ef1234567890'
// 安全存储
safeLocalStorage.set('user', { name: '张三' })
safeLocalStorage.get('user') // { name: '张三' }
// Worker 执行(不阻塞主线程)
const sum = await runInWorker(
(nums) => nums.reduce((a, b) => a + b, 0),
[1, 2, 3, 4, 5]
) // 15
MIT
FAQs
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.