Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
babel-plugin-lodash-legacy
Advanced tools
Lodash modularized builds without the hassle (for babel5)
The goal of this package is to be an alternative/augmentation of lodash-modularize which is designed with slightly different goals.
This plugin is a simple transform to remove unused lodash code, without forcing the user to cherry pick methods manually. This lets you use lodash naturally (aka as documented) without worrying about bundling parts you're not using.
babel5 is no longer officially supported. This plugin is for the rare few who are still on babel5 but have yet to (and should) update to latest. Use at your own risk!
Converts
import lodash from 'lodash';
lodash.map([1, 2, 3], function(x) {
// ...
});
(roughly) to
import _map from 'lodash/collection/map';
_map([1, 2, 3], function(x) {
// ...
});
Where's my npm module support?
It will be implemented when plugins can support options (babel/babel#1833).
For now use lodash-modularize.
Do import specifiers work (
import {x} from 'lodash'
)
You know it! You can also use both specifiers and direct imports (import _, {y} from 'lodash'
).
What about
lodash-fp
?
We've got ya covered (#3).
You must be using ES6 imports to load lodash.
Chaining syntax is not supported
.babelrc
(Recommended){
"plugins": ["lodash"]
}
$ babel --plugins lodash script.js
require("babel-core").transform("code", {
plugins: ["lodash"]
});
FAQs
Lodash modularized builds without the hassle (for babel5)
The npm package babel-plugin-lodash-legacy receives a total of 1 weekly downloads. As such, babel-plugin-lodash-legacy popularity was classified as not popular.
We found that babel-plugin-lodash-legacy demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.