
Security News
OWASP 2025 Top 10 Adds Software Supply Chain Failures, Ranked Top Community Concern
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.
babel-plugin-extend-scope-chain
Advanced tools
[](https://www.npmjs.org/package/babel-plugin-extend-scope-chain) [ { /* your script */ }.
foo assignment expressionInput:
foo = "bar";
Output:
window.foo = "bar";
foo.bar assignment expressionInput:
foo.bar = "bar";
Output:
window.foo.bar = "bar";
Input:
var foo = "bar";
Output:
window.foo = "bar";
To bundle external scripts.
A specific use case for which this was developed is to bundle external supply-side platform (SSP) scripts into the main script. This enables us to decrease the amount of HTTP requests that are required to start header bidding.
The problem is that all vendor scripts assume that the script is loaded asynchronously, using script tags, e.g.
const scriptElement = document.createElement('script');
scriptElement.async = true;
scriptElement.src = '//script.js';
document.head.appendChild(scriptElement);
This assumption allows them to write code such as:
var foo = foo || 'bar';
In the above example, if foo is not set, window.foo becomes {}.
We want to bundle and delay these script execution, i.e.
function loadVendorFoo () {
var foo = foo || 'bar';
}
The above code breaks, because now foo is isolated to loadVendorFoo scope, i.e. in the above code foo will always equal "bar".
Using this transpiler, we namespace all global variable declarations using window object, i.e. our script becomes:
function loadVendorFoo () {
var foo = window.foo = window.foo || 'bar';
}
| Name | Type | Description | Default |
|---|---|---|---|
globals | Array<string> | Names of global variables that must not be namespaced. | ['window'] |
export | boolean | Wraps the script body in a function and exports the function using module.exports. | false |
FAQs
[](https://www.npmjs.org/package/babel-plugin-extend-scope-chain) [
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.