
Research
NPM targeted by malware campaign mimicking familiar library names
Socket uncovered npm malware campaign mimicking popular Node.js libraries and packages from other ecosystems; packages steal data and execute remote code.
@superhuman/command-score
Advanced tools
Yet another javascript fuzzy string matching library!
We use this in the Superhuman email client in autocompletion contexts where the set of results is relatively bounded, and we want to allow for considerable fuzziness in the matching. See also trieing, which is used when the set is unbounded or when metrics other than matchiness are most important.
npm install command-score
var commandScore = require('command-score');
function getMatches (query) {
var items = ["red", "green", "gold", blue"];
var results = [];
items.forEach(function (item) {
var score = commandScore(item, query)
if (score > 0) {
results.push({score: score, item: item});
}
})
return results.sort(function (a, b) {
if (a.score === b.score) {
return a.item.localeCompare(b.item);
}
return b.score - a.score;
}).map(function (suggestion) {
return suggestion.item;
});
}
Given a query and a string to match against, returns a matchiness score designed to sort strings by how likely the user is to want the string given the query. The scores are scaled between 0 and 1, and are only designed to be comparable if you keep the query the same and compare the scores against different strings (or, but less usefully, keep the string the same and try different queries).
Care is taken to reduce artificial differences in matchiness scores, so that many strings may end up having the same score for a given query. This lets us use a secondary sort on top of matchiness.
In each of the word-jump, character-jump, and long-jump cases, a further small penalty is added so that shorter jumps are considered more matchy.
FAQs
Yet another javascript fuzzy matching library
The npm package @superhuman/command-score receives a total of 20 weekly downloads. As such, @superhuman/command-score popularity was classified as not popular.
We found that @superhuman/command-score demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 9 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovered npm malware campaign mimicking popular Node.js libraries and packages from other ecosystems; packages steal data and execute remote code.
Research
Socket's research uncovers three dangerous Go modules that contain obfuscated disk-wiping malware, threatening complete data loss.
Research
Socket uncovers malicious packages on PyPI using Gmail's SMTP protocol for command and control (C2) to exfiltrate data and execute commands.