
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
babel-plugin-extend-scope-chain
Advanced tools
[](https://www.npmjs.org/package/babel-plugin-extend-scope-chain) [ { /* your script */ }
.
foo
assignment expressionInput:
foo = "bar";
Output:
window.foo = "bar";
foo.bar
assignment expressionInput:
foo.bar = "bar";
Output:
window.foo.bar = "bar";
Input:
var foo = "bar";
Output:
window.foo = "bar";
To bundle external scripts.
A specific use case for which this was developed is to bundle external supply-side platform (SSP) scripts into the main script. This enables us to decrease the amount of HTTP requests that are required to start header bidding.
The problem is that all vendor scripts assume that the script is loaded asynchronously, using script tags, e.g.
const scriptElement = document.createElement('script');
scriptElement.async = true;
scriptElement.src = '//script.js';
document.head.appendChild(scriptElement);
This assumption allows them to write code such as:
var foo = foo || 'bar';
In the above example, if foo
is not set, window.foo
becomes {}
.
We want to bundle and delay these script execution, i.e.
function loadVendorFoo () {
var foo = foo || 'bar';
}
The above code breaks, because now foo
is isolated to loadVendorFoo
scope, i.e. in the above code foo
will always equal "bar".
Using this transpiler, we namespace all global variable declarations using window
object, i.e. our script becomes:
function loadVendorFoo () {
var foo = window.foo = window.foo || 'bar';
}
Name | Type | Description | Default |
---|---|---|---|
globals | Array<string> | Names of global variables that must not be namespaced. | ['window'] |
export | boolean | Wraps the script body in a function and exports the function using module.exports . | false |
FAQs
[](https://www.npmjs.org/package/babel-plugin-extend-scope-chain) [.
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.