
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
@userfrosting/vinyl-fs-vpath
Advanced tools
Vinyl source for file system with support for virtual paths.
| Branch | Status |
|---|---|
| master |
Vinyl source for file system with support for virtual paths. Uses globby for file discovery.
npm i -D @userfrosting/vinyl-fs-vpath
IMPORTANT
This is an ES module package targeting NodeJS^12.17.0 || >=13.2.0, refer to the NodeJS ESM docs regarding how to correctly import. ESM loaders like@babel/loaderoresmlikely won't work as expected.
// gulpfile.mjs
import { src } from "@userfrosting/vinyl-fs-vpath";
import { dest } from "gulp";
import terser from "gulp-terser";
import concatJs from "gulp-concat-js";
export function bundle() {
return src(
[ "src/**/*.js", "!src/**/*/*.test.js" ],
[
[ "./src/layer-1/", "./src/" ],
[ "./src/layer-2/", "./src/" ]
]
)
.pipe(concatJs("main.js"))
.pipe(terser())
.pipe(dest("public/assets/"));
}
$ gulp bundle
./
+ src/
| + special.test.js
| + README.md
| + layer-1/
| | + a.js
| | + b.js
| + layer-2/
| + a.js
| + c.js
| + c.test.js
+ public/assets/
+ a.js (from src/layer-2)
+ b.js (from src/layer-1)
+ c.js (from src/layer-2)
dest?Applying virtual path logic requires knowledge, without it there is no way to perform the operation in a deterministic manner. src does this by finding all the files and then performing the virtual path logic against the complete set, such an approach however does map translate to dest well. Memory pressure is a significant concern (that has no easy workaround) and perhaps more importantly it hurts the efficiency of the overall pipeline by introducing back-pressure (tasks later in the pipeline remain idle, reducing opportunity for asynchronous operations to be run).
I can see a need for mid-stream or end-of-stream virtual path operations in more specialized scenarios, so if its needed file an issue. Much of the logic already exists in @userfrosting/gulp-bundle-assets@^3, so it would not be a significant undertaking. The scope would most likely be limited to mid-stream operations to avoid duplicating the functionality of gulp.dest which can just be chained immediately after.
API documentation is regenerated for every release using API Extractor and API Documenter. The results reside in docs/api.
Generally speaking, all releases should first traverse through alpha, beta, and rc (release candidate) to catch missed bugs and gather feedback as appropriate. Aside from this however, there are a few steps that MUST always be done.
CHANGELOG.md is up to date.npm like npm version 3.0.0 or npm version patch.npm publish.npm version.[3.0.3] - 2022-03-16
FAQs
Vinyl source for file system with support for virtual paths.
We found that @userfrosting/vinyl-fs-vpath demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.