
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
array-move
Advanced tools
Move an array item to a different position
$ npm install array-move
import {arrayMoveImmutable} from 'array-move';
const input = ['a', 'b', 'c'];
const array1 = arrayMoveImmutable(input, 1, 2);
console.log(array1);
//=> ['a', 'c', 'b']
const array2 = arrayMoveImmutable(input, -1, 0);
console.log(array2);
//=> ['c', 'a', 'b']
const array3 = arrayMoveImmutable(input, -2, -3);
console.log(array3);
//=> ['b', 'a', 'c']
Clones the given array, moves the item to a new position in the new array, and then returns the new array. The given array is not mutated.
Moves the item to the new position in the array array. Useful for huge arrays where absolute performance is needed.
Type: Array
Type: number
The index of item to move.
If negative, it will begin that many elements from the end.
Type: number
The index of where to move the item.
If negative, it will begin that many elements from the end.
The `array-move-item` package also allows you to move items within an array. It is similar to `array-move` but may have different performance characteristics or additional utility functions.
FAQs
Move an array item to a different position
The npm package array-move receives a total of 246,704 weekly downloads. As such, array-move popularity was classified as popular.
We found that array-move demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.