
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
@wikimedia/resource-modules
Advanced tools
[](https://travis-ci.org/joakin/resource-modules)
CLI tool that lints frontend resources in mediawiki extensions. Analyzes the sources and builds a dependency tree from source, and then lints that information with the extension.json ResourceModules declarations.
It assumes the mediawiki extension contains a resources/ folder with the
frontend assets and a extension.json file with a ResourceModules key with
the ResourceLoader configuration.
See T146748 for more information.
You can install it globally and use it from the command line:
npm install -g resource-modules
resource-modules ~/mediawiki-vagrant/mediawiki/extensions/Popups/
You can also set it up locally for your project:
npm install --save-dev resource-modules
# Add a script in package.json
# "scripts": {
# "lint": "resource-modules ./"
# }
npm run lint
mw.template.get with string literals (no variables)mw.msg with string literalsmw.mobileFrontend.define &
mw.mobileFrontend.require)
M.definesM.required modules are M.defined in some dependency script
(in same ResourceModule or a dependency)mw.mobileFrontend.define &
mw.mobileFrontend.require)
M.definesM.required modules are M.defined in some dependency script
(in same ResourceModule or a dependency)mw namespaces/usages
mw.X = { ... }, mw.X.Y = ... and
$.extend( mw.X, { Y: ... } ), from the extension and core.mw.X in sourcesmw.X globals are not in previously defined scripts in
ResourceModulesSometimes there are highly dynamic interactions on the code that can't be linted, for example, MobileFrontend using messages defined on VisualEditor, so they aren't in MobileFrontend's extension.json.
In those cases, use // resource-modules-disable-line in the line that is
giving you the lint error to avoid parsing of that line and thus the error.
Example:
// ...
switchToolbar.setup([
{
type: "list",
icon: "edit",
title: mw.msg("visualeditor-mweditmode-tooltip"), //resource-modules-disable-line
include: ["editModeVisual", "editModeSource"]
}
]);
require/module.exports that
ResourceLoader exposes (ResourceModule based scope instead of file based scope
like in common.js modules)resource-modules requires node.js 6+ and is written in typed javascript using
typescript
npm install
npm start /path/to/mediawiki/extension
To run the type checker, and tests:
npm test
If you want to run them in watch mode:
npm install -g nodemon
nodemon -e "ts" -w src/ --exec "npm test"
To release, first build the artifacts and then publish:
npm run dist
npm version <major|minor|patch>
git push --tags && git push
npm publish
FAQs
[](https://travis-ci.org/joakin/resource-modules)
We found that @wikimedia/resource-modules demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 9 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.