Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@xstate/inspect
Advanced tools
This package contains inspection tools for XState.
Check out the XState + Vue Minute Timer + Viz example on CodeSandbox
npm install @xstate/inspect
# or yarn add @xstate/inspect
Via CDN
<script src="https://unpkg.com/@xstate/inspect/dist/xstate-inspect.umd.min.js"></script>
By using the global variable XStateInspect
import { inspect } from '@xstate/inspect';
inspect({
// options
// url: 'https://stately.ai/viz?inspect', // (default)
iframe: false // open in new window
});
{ devTools: true }
to any interpreted machines you want to visualize:import { interpret } from 'xstate';
import { inspect } from '@xstate/inspect';
// ...
const service = interpret(someMachine, { devTools: true });
service.start();
url
(optional) - The endpoint that the Inspector sends events to. Default: https://stately.ai/viz?inspectiframe
(optional) - The iframe that loads the provided URL. If iframe is set to false
, then a new tab is opened instead.devTools
(optional) - Allows custom implementation for lifecycle hooks.serialize
(optional) - A custom serializer for messages sent to the URL endpoint. Useful for sanitizing sensitive information, such as credentials, from leaving your application.targetWindow
(optional) - Provide a pre-existing window location that will be used instead of opening a new window etc. When using this option, you must still provide the url
value due to security checks in browser APIs, and the iframe
option is ignored in such a case.When is this useful?
credentials
// Remove credentials from being forwarded
inspect({
serialize: (key: string, value: any) => {
return key === "credentials" && typeof value === "object" ? {} : value;
},
});
// Add a custom local log
inspect({
serialize: (key: string, value: any) => {
if (key === "ready") {
console.log("Detected ready key");
}
return value;
},
});
When is this useful?
console.log
statements to your machine definitions// The URL and port of your local project (ex. Vite, Webpack, etc).
const url = "http://127.0.0.1:5174/"
const inspector = inspect({
url,
iframe: undefined,
targetWindow: window
});
// In the same window, subsribe to messages from @xstate/inspector
createWindowReceiver({}).subscribe(console.log);
// Start your machine, and all events generated are logged to the console
interpret(machine, { devTools: true }).start({});
When is this useful?
// In your client application
const url = "http://127.0.0.1:8443/"
const targetWindow = window.open(url);
const inspector = inspect({
// The URL must still be provided. This is used by postMessage, as it's
// not possible to do targetWindow.location for security reasons
url,
targetWindow
});
// In the second, hosted application
createWindowReceiver({}).subscribe((event) => {
if (event.type === "service.register") {
// Do something when a new machine is started
} else if (event.type === "service.stop") {
// Do something when a machine enters a terminal state
} else if (event.type === "service.event") {
// Do something when a machine recieves an event
} else if (event.type === "service.state") {
// Do something when a machine enters to a new state
// Note: Does not handle transitional states.
}
});
FAQs
XState inspection utilities
The npm package @xstate/inspect receives a total of 93,592 weekly downloads. As such, @xstate/inspect popularity was classified as popular.
We found that @xstate/inspect demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.