
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
babel-plugin-extend-scope-chain
Advanced tools
[](https://www.npmjs.org/package/babel-plugin-extend-scope-chain) [ { /* your script */ }.
foo assignment expressionInput:
foo = "bar";
Output:
window.foo = "bar";
foo.bar assignment expressionInput:
foo.bar = "bar";
Output:
window.foo.bar = "bar";
Input:
var foo = "bar";
Output:
window.foo = "bar";
To bundle external scripts.
A specific use case for which this was developed is to bundle external supply-side platform (SSP) scripts into the main script. This enables us to decrease the amount of HTTP requests that are required to start header bidding.
The problem is that all vendor scripts assume that the script is loaded asynchronously, using script tags, e.g.
const scriptElement = document.createElement('script');
scriptElement.async = true;
scriptElement.src = '//script.js';
document.head.appendChild(scriptElement);
This assumption allows them to write code such as:
var foo = foo || 'bar';
In the above example, if foo is not set, window.foo becomes {}.
We want to bundle and delay these script execution, i.e.
function loadVendorFoo () {
var foo = foo || 'bar';
}
The above code breaks, because now foo is isolated to loadVendorFoo scope, i.e. in the above code foo will always equal "bar".
Using this transpiler, we namespace all global variable declarations using window object, i.e. our script becomes:
function loadVendorFoo () {
var foo = window.foo = window.foo || 'bar';
}
| Name | Type | Description | Default |
|---|---|---|---|
globals | Array<string> | Names of global variables that must not be namespaced. | ['window'] |
export | boolean | Wraps the script body in a function and exports the function using module.exports. | false |
FAQs
[](https://www.npmjs.org/package/babel-plugin-extend-scope-chain) [
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.