Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Convenient and readability improving parameter binding for asynchronous JavaScript functions.
asca = require 'asca'
sayHi = asca (name, done) ->
console.log "Hello #{name}"
done()
sayHi
method behaves completely normal if called normally,
i.e. given all parameterssayHi 'world', -> #> "Hello world" & calls the given method when done
sayHi
method returns a method with all the given parameters bound to it.
This method can be called later by just giving it the callback.sayWorldLater = sayHi 'world' # 'sayWorldLater' is the sayHi method with
# the argument 'world' bound to it
sayWorldLater -> #> "Hello world" & calls the given method when done
# instead of this madness
async.parallel [
(done) -> sayHi 'world', done
(done) -> sayHi 'universe', done
]
# or this mess
async.parallel [
sayHi.bind this, 'world'
sayHi.bind this, 'universe'
]
# we can now say
async.parallel [
sayHi 'world'
sayHi 'universe'
]
Or in many other places that call a method later
# instead of
setTimeout (-> sayHi 'world'), 2000
# we can now say
setTimeout sayHi('world'), 2000
All asynchronous JavaScript methods should behave like this.
There are other libraries like curry that provide more comprehensive currying and binding, and might be more appropriate depending on what you want to do. This library is focussed around delayed asynchrounous function calling, performs error checking specifically for this use case, and does that with high performance while being extremely lightweight.
FAQs
Convenient parameter binding for asynchronous functions
The npm package asca receives a total of 8 weekly downloads. As such, asca popularity was classified as not popular.
We found that asca demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.