Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
A micro-module to prevent side-effects.
(Utilizes deep-copy)
Side-Effects are evil. Protect your functions from the bane of side-effects with armour
, the paladin of JS functions.
Quoting wikipedia: "In computer science, a function or expression is said to have a side effect if, in addition to returning a value, it also modifies some state or has an observable interaction with calling functions or the outside world."
Yes, but JS does pass-by-value of a reference for non-primitive types, hence why - while JS technically is not a pass-by-reference language - the result is the same as a pass-by-reference...
Utimately, all that matters is that if you do:
var o = { name: 'joe'};
function change(obj) {
o.name = 'changed';
}
change(o); // o.name is now 'changed'
your o
object is busted.
JavaScript is susceptible to side-effects because it is possible to modify variables outside of a function's scope (something that is very useful when using closures, if you know what you're doing), and because of call-by-value/sharing/mood behaviour.
For example, your junior developer has developed this beauty:
function mul(arr, val) {
var i = 0,
len = arr.length;
for (i; i < len; i += 1) {
arr[i] = arr[i] * val;
}
return arr;
}
after appropriate corporal punishment of the developer in question, you decide to prevent the original array from being ruined by inexperienced/ insane / sado-masochist developers.
var armour = require('armour');
var safeMul = armour.protect(mul); // that piece of genius code above
now if you have an array var a = [1, 2, 3];
and pass it into mul
:
var b = mul(a, 3); // a and b are now [3, 6, 9]
var c = safeMul(b, 3); // b is [3, 6, 9] and c is [9, 18, 27]
You can also protect an entire object with protectObject
: this means you can pass an object and if any of its properties are functions, they will be protected so they don't cause side effects:
var o = { mul: mul }; // re-utilizing the code-of-the-century function above
var protected = armour.protectObject(o); // now protected.mul is side-effects-safe
FAQs
side-effects prevention facility
We found that armour demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.