Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@zambezi/babel-plugin-transform-es2015-modules-umd
Advanced tools
This plugin transforms ES2015 modules to UMD
$ npm install babel-plugin-transform-es2015-modules-umd
.babelrc
(Recommended).babelrc
{
"plugins": ["transform-es2015-modules-umd"]
}
You can also override the names of particular libraries when this module is
running in the browser. For example the es6-promise
library exposes itself
as global.Promise
rather than global.es6Promise
. This can be accommodated by:
{
"plugins": [
["transform-es2015-modules-umd", {
"globals": {
"es6-promise": "Promise"
}
}]
]
}
There are a few things to note about the default semantics.
First, this transform uses the basename of each import to generate the global names in the UMD output. This means that if you're importing multiple modules with the same basename, like:
import fooBar1 from "foo-bar";
import fooBar2 from "./mylib/foo-bar";
it will transpile into two references to the same browser global:
factory(global.fooBar, global.fooBar);
If you set the plugin options to:
{
"globals": {
"foo-bar": "fooBAR",
"./mylib/foo-bar": "mylib.fooBar"
}
}
it will still transpile both to one browser global:
factory(global.fooBAR, global.fooBAR);
because again the transform is only using the basename of the import.
Second, the specified override will still be passed to the toIdentifier
function in babel-types/src/converters.
This means that if you specify an override as a member expression like:
{
"globals": {
"fizzbuzz": "fizz.buzz"
}
}
this will not transpile to factory(global.fizz.buzz)
. Instead, it will
transpile to factory(global.fizzBuzz)
based on the logic in toIdentifier
.
Third, you cannot override the exported global name.
exactGlobals: true
All of these behaviors can limit the flexibility of the globals
map. To
remove these limitations, you can set the exactGlobals
option to true
.
Doing this instructs the plugin to:
globals
overrides to the toIdentifier
function. Instead,
they are used exactly as written, so you will get errors if you do not use
valid identifiers or valid uncomputed (dot) member expressions.globals
map. Any
override must again be a valid identifier or valid member expression.Thus, if you set exactGlobals
to true
and do not pass any overrides, the
first example of:
import fooBar1 from "foo-bar";
import fooBar2 from "./mylib/foo-bar";
will transpile to:
factory(global.fooBar, global.mylibFooBar);
And if you set the plugin options to:
{
"globals": {
"foo-bar": "fooBAR",
"./mylib/foo-bar": "mylib.fooBar"
},
"exactGlobals": true
}
then it'll transpile to:
factory(global.fooBAR, global.mylib.fooBar)
Finally, with the plugin options set to:
{
"plugins": [
"external-helpers",
["transform-es2015-modules-umd", {
"globals": {
"my/custom/module/name": "My.Custom.Module.Name"
},
"exactGlobals": true
}]
],
"moduleId": "my/custom/module/name"
}
it will transpile to:
factory(mod.exports);
global.My = global.My || {};
global.My.Custom = global.My.Custom || {};
global.My.Custom.Module = global.My.Custom.Module || {};
global.My.Custom.Module.Name = mod.exports;
$ babel --plugins transform-es2015-modules-umd script.js
require("babel-core").transform("code", {
plugins: ["transform-es2015-modules-umd"]
});
FAQs
This plugin transforms ES2015 modules to UMD
We found that @zambezi/babel-plugin-transform-es2015-modules-umd demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.