
Security News
PodRocket Podcast: Inside the Recent npm Supply Chain Attacks
Socket CEO Feross Aboukhadijeh discusses the recent npm supply chain attacks on PodRocket, covering novel attack vectors and how developers can protect themselves.
@kmdavis/baskerville
Advanced tools
Sir Arthur Conan Doyle's The Hound of the User Agent
Baskerville will sniff a user agent string and provide some analysis of what it might mean.
npm install @kmdavis/baskerville
Baskerville has 2 main methods: tokenize
, and process
.
Tokenize will return an array of tokens, for example:
import Baskerville from "@kmdavis/baskerville";
Baskerville.tokenize("Mozilla/5.0 (compatible; Konqueror/4.4; Linux 2.6.32-22-generic; X11; en_US) KHTML/4.4.3 (like Gecko) Kubuntu");
will return the following tokens:
[
{
name: "compatible",
},
{
name: "en_US",
},
{
name: "KHTML",
version: "4.4.3",
like: "Gecko",
},
{
name: "Konqueror",
version: "4.4",
},
{
name: "Kubuntu",
},
{
name: "Linux",
version: "2.6.32-22-generic",
},
{
name: "Mozilla",
version: "5.0",
},
{
name: "X",
version: "11",
},
]
Process takes that array of tokens and does a little... processing... on it.
Baskerville.process("Mozilla/5.0 (compatible; Konqueror/4.4; Linux 2.6.32-22-generic; X11; en_US) KHTML/4.4.3 (like Gecko) Kubuntu");
will return:
[
{
name: "compatible",
},
{
name: "en_US",
},
{
type: "browser",
name: "KHTML",
version: "4.4.3",
like: "Gecko",
},
{
type: "browser",
name: "Konqueror",
version: "4.4",
},
{
type: "os",
name: "Kubuntu",
},
{
type: "os",
name: "Linux",
version: "2.6.32-22-generic",
},
{
type: "browser",
name: "Mozilla",
version: "5.0",
},
{
name: "X",
version: "11",
},
]
The built-in processing is rather minimal: it will normalize version strings
(replacing underscores with dots), identify browsers and operating systems, and
the "security token" (N, U, or I). For additional processing, we expose a
registerProcessor
method that allows you to create a processor plugin. For
example, you could use this to sort browsers or operating systems into buckets,
like mobile vs desktop, linux-based, etc. You could also use it to convert our
string versions into Version objects:
Baskerville.registerProcessor(function wrapVersions (token) {
if (token.version) {
token.version = new Version(token.version);
}
});
Or you could parse the locale token ("en_US" in the example above):
var carmen = require("@kmdavis/carmen"); // https://github.com/kmdavis/carmen
Baskerville.registerProcessor(function identifyLocale (token) {
var locale = carmen.parse(token.name); // will return undefined if it can't parse
if (locale) {
token.type = "locale";
token.details = locale;
return true; // We assume full ownership and responsibility for this token.
}
return false; // Let the other children play
});
In the example above, if a processor returns true, no further processing will be performed on that token. Also, don't be scared to modify the token, you're not modifying the original token, but rather a copy. The token or array of tokens passed into baskerville.process is not modified in any way.
npm install
npm test
Kevan Davis kevan.davis@me.com
Distributed under the MIT license.
https://github.com/kmdavis/baskerville
git checkout -b feature/fooBar
)git commit -am 'Add some fooBar'
)git push origin feature/fooBar
)FAQs
Sir Arthur Conan Doyle's The Hound of the User Agent
We found that @kmdavis/baskerville demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Socket CEO Feross Aboukhadijeh discusses the recent npm supply chain attacks on PodRocket, covering novel attack vectors and how developers can protect themselves.
Security News
Maintainers back GitHub’s npm security overhaul but raise concerns about CI/CD workflows, enterprise support, and token management.
Product
Socket Firewall is a free tool that blocks malicious packages at install time, giving developers proactive protection against rising supply chain attacks.