
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
babel-plugin-transform-es2015-modules-umd-exact-globals
Advanced tools
This is babel-plugin-transform-es2015-modules-umd but with the exactGlobals option from https://github.com/babel/babel/pull/3534
This is babel-plugin-transform-es2015-modules-umd but with the exactGlobals option from https://github.com/babel/babel/pull/3534
$ npm install babel-plugin-transform-es2015-modules-umd-exact-globals
.babelrc
(Recommended).babelrc
{
"plugins": ["transform-es2015-modules-umd-exact-globals"]
}
You can also override the names of particular libraries when this module is
running in the browser. For example the es6-promise
library exposes itself
as global.Promise
rather than global.es6Promise
. This can be accommodated by:
{
"plugins": [
["transform-es2015-modules-umd-exact-globals", {
"globals": {
"es6-promise": "Promise"
}
}]
]
}
There are a few things to note about the default semantics.
First, this transform uses the basename of each import to generate the global names in the UMD output. This means that if you're importing multiple modules with the same basename, like:
import fooBar1 from "foo-bar";
import fooBar2 from "./mylib/foo-bar";
it will transpile into two references to the same browser global:
factory(global.fooBar, global.fooBar);
If you set the plugin options to:
{
"globals": {
"foo-bar": "fooBAR",
"./mylib/foo-bar": "mylib.fooBar"
}
}
it will still transpile both to one browser global:
factory(global.fooBAR, global.fooBAR);
because again the transform is only using the basename of the import.
Second, the specified override will still be passed to the toIdentifier
function in babel-types/src/converters.
This means that if you specify an override as a member expression like:
{
"globals": {
"fizzbuzz": "fizz.buzz"
}
}
this will not transpile to factory(global.fizz.buzz)
. Instead, it will
transpile to factory(global.fizzBuzz)
based on the logic in toIdentifier
.
Third, you cannot override the exported global name.
exactGlobals: true
All of these behaviors can limit the flexibility of the globals
map. To
remove these limitations, you can set the exactGlobals
option to true
.
Doing this instructs the plugin to:
globals
overrides to the toIdentifier
function. Instead,
they are used exactly as written, so you will get errors if you do not use
valid identifiers or valid uncomputed (dot) member expressions.globals
map. Any
override must again be a valid identifier or valid member expression.Thus, if you set exactGlobals
to true
and do not pass any overrides, the
first example of:
import fooBar1 from "foo-bar";
import fooBar2 from "./mylib/foo-bar";
will transpile to:
factory(global.fooBar, global.mylibFooBar);
And if you set the plugin options to:
{
"globals": {
"foo-bar": "fooBAR",
"./mylib/foo-bar": "mylib.fooBar"
},
"exactGlobals": true
}
then it'll transpile to:
factory(global.fooBAR, global.mylib.fooBar)
Finally, with the plugin options set to:
{
"plugins": [
"external-helpers",
["transform-es2015-modules-umd-exact-globals", {
"globals": {
"my/custom/module/name": "My.Custom.Module.Name"
},
"exactGlobals": true
}]
],
"moduleId": "my/custom/module/name"
}
it will transpile to:
factory(mod.exports);
global.My = global.My || {};
global.My.Custom = global.My.Custom || {};
global.My.Custom.Module = global.My.Custom.Module || {};
global.My.Custom.Module.Name = mod.exports;
$ babel --plugins transform-es2015-modules-umd-exact-globals script.js
require("babel-core").transform("code", {
plugins: ["transform-es2015-modules-umd-exact-globals"]
});
FAQs
This is babel-plugin-transform-es2015-modules-umd but with the exactGlobals option from https://github.com/babel/babel/pull/3534
The npm package babel-plugin-transform-es2015-modules-umd-exact-globals receives a total of 0 weekly downloads. As such, babel-plugin-transform-es2015-modules-umd-exact-globals popularity was classified as not popular.
We found that babel-plugin-transform-es2015-modules-umd-exact-globals demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.