Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
abomination
Advanced tools
a language for manipulating data written in json
function definitions are passed as javascript objects, but all data types used in the configs
are JSON compatible. the expectation is that the javascript object could have come from JSON.parse
.
its functions all the way down bud.
except for objects, which are literals if they don't have a fn
key in them. if they have a fn
key
they're function definitions and will be executed.
see integration tests for more examples.
concatenate strings:
const fn = {
fn: 'concat',
parts: ['hello', {fn: 'value', name: 'thing.stuff'}],
delimiter: ' '
}
const input = {
thing: {stuff: 'world'}
}
// returns 'hello world'
execute(fn, input))
map array, extract value, join using user defined function:
const fn = {
with: {
fn: 'define',
function: 'join-with-comma',
body: {fn: 'concat', delimiter: ',', parts: {fn: 'param', name: 'parts'}}
},
fn: 'join-with-comma',
parts: {
fn: 'map',
array: {fn: 'value', name: '.'},
map: {fn: 'value', name: 'id'}
}
}
const input = [{id: 'first thing'}, {id: 'second thing'}];
// returns 'first thing,second thing'
execute(fn, input));
input:
name
: the name of the value to retrieveretrieves a value from scope. can retrieve nested values using dot notation. the name .
matches the entire current scope.
parent scopes can be accessed, if a value name isn't found in the current scope it'll look higher up.
input:
array
: an array of strings to concatenatedelimiter
(optional): delimiter to put between the parts, default: ''concatenates a list of strings into one string.
input:
array
: an array of stuff to mapmap
: the function to map. inside this function the scope is the array item.maps a list of things into a list of different things.
input:
variable
(optional): variable name to define (must provide either variable or function name)function
(optional): function name to define (must provide either variable or function name)body
: the variable value or function definitiondefines a variable or function. returns null. functions have a with
reserved key to put definitions in. values defined
in a with
affect all sub-scopes, values and function definitions can be overwritten by sub-scopes. function definitions
have access to a param
function which retrieves a parameter from the function usage.
FAQs
a language written in json for manipulating data
We found that abomination demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.