
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
JSON-like parser/formatter to pass objects between processes and/or threads
JASON is just like JSON, but with an A. D'oh. ^U
JASON is just like JSON, but unlike JSON it can:
.parse()
with their proper types/classes.undefined
JASON lets you pass objects as text between processes and/or threads.
Warning: unlike JSON, JASON is unsafe. You should only use it in contexts where you have strong guarantees that the strings that you pass to the JASON parser have been produced by a JASON formatter from a trusted source.
JASON syntax is just plain JavaScript (but not JSON).
The stringify
function does the clever work of generating whatever Javascript is needed to recreate the object, and the parse
function is just a call to eval
.
See the test/test01.js
file.
var JASON = require("JASON");
str = JASON.stringify(obj);
obj = JASON.parse(str);
The easiest way to install JASON
is with NPM:
npm install JASON
JASON won't capture any free vars' values in the serializations. If a JASON serialization contains any functions or methods that contain references to free vars (any other than the built-in globals), most of the times bad things will happen, unless the referenced free vars exist as well and are in scope in the context in which the serialization is JASON.parse()d (the global context), or unless the serialization is eval()ed in a context in which said references exist and are in scope.
For example here pi
is a free var:
var txt= JASON.stringify(function () { return pi });
So this usually won't work:
JASON.parse(txt)();
ReferenceError: pi is not defined
unless there's a pi
var in scope:
var pi= 3.14;
JASON.parse(txt)();
3.14
This work is licensed under the MIT license.
FAQs
JSON-like parser/formatter to pass objects between processes and/or threads
The npm package JASON receives a total of 534 weekly downloads. As such, JASON popularity was classified as not popular.
We found that JASON demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.