Security News
New Python Packaging Proposal Aims to Solve Phantom Dependency Problem with SBOMs
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
babel-plugin-rewrite-require
Advanced tools
This plugin allows rewriting ES6 module imports and CommonJS-style
require()
calls using a simple module alias map:
{
"aliases": {
"some-module": "some-replacement-module",
"another-module": "another-module/browser"
},
}
With the following option enabled, require()
calls that do not have
a simple string literal argument will be replaced with an exception
being thrown:
{
"throwForNonStringLiteral": true
}
This approach is used by several browserify modules to detect whether
their built-in counterparts are available (e.g. require('cry'+'pto')
)
and should be enabled if you use this Babel plugin to alias node
built-in modules to browserify modules.
A common pattern found in node modules is to check whether a certain dependency is available:
try {
require('some-optional-dependency');
} catch (ex) {
// Ignore, or load polyfill, or ...
}
Because React Native's packager resolves require()
calls during
dependency resolution, it will require 'some-optional-dependency'
to
be present and resolvable. If this module will never be available to
your React Native app, and you want the runtime exception occur so
that the catch
clause can do its thing, you can blacklist these
dependencies from ever being resolved. Instead, those require()
calls will be replaced with an exception being thrown:
{
"throwForModules": [
"some-optional-dependency"
]
}
If the file that an import or require()
call would resolve to is
missing, it's usually up to node or the packager (e.g. webpack) to
deal with that -- potentially creating the bundle would fail at build
time rather than incurring an exception at runtime (which is what
happens in node). To replace the import of an non-existent file or
module with a runtime exception, use the following option:
{
"throwForMissingFiles": [
"/path/to/some/optional/configuration.json",
"/path/to/build.artifact"
]
}
FAQs
Babel plugin for rewriting requires/imports
The npm package babel-plugin-rewrite-require receives a total of 1,895 weekly downloads. As such, babel-plugin-rewrite-require popularity was classified as popular.
We found that babel-plugin-rewrite-require demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
Security News
Socket CEO Feross Aboukhadijeh discusses open source security challenges, including zero-day attacks and supply chain risks, on the Cyber Security Council podcast.
Security News
Research
Socket researchers uncover how threat actors weaponize Out-of-Band Application Security Testing (OAST) techniques across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.