Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
babel-plugin-transform-replace-object-assign
Advanced tools
Allows you to provide custom implementation of Object.assign in babel builds
Replaces Object.assign
with a custom implementation that you provide in plugin configuration. This plugin works similarly to the babel-plugin-transform-object-assign plugin except it allows you to provide your own implementation that you would like to replace Object.assign
with rather than the _extends
helper that Babel uses.
Also, this plugin will import an external package in files where Object.assign
is used rather than redeclaring the function in each file (which should help reduce bundle size). This is ultimately what babel-plugin-transform-runtime does for you when using the _extends
helper.
The implementation you configure is specified as a npm package dependency.
Most likely you do not and should not use this plugin! I initially wrote this plugin due to a bug in Chrome where key order was not gaurenteed to be correct for objects mutated with Object.assign
(the issue is also described at sindresorhus/object-assign#22).
While the bug did not cause problems for most projects, it did causes problems for a project I was helping maintain (Material-UI). We heavily used Object.assign
to merge style definitions that were defined in javascript objects. Since key order is important when defining CSS style rules, the Object.assign
implementation built into Chrome caused many style related bugs. This plugin allowed us to completely replace all uses of Object.assign
within our source code with an implementation that did not break in Chrome (with the expectation that we would stop using this plugin when the bug was fixed and rolled out to a majority of Chrome users).
The bug in Chrome has been fixed for quite some time now (it was fixed in Chrome 49), so this plugin is no longer necessary for the purpose it was originally created for. We have also stopped using this plugin for Material-UI. Please carefully consider the necessity and implications of replacing all of your Object.assign
calls before using this plugin. If you are not sure if you need this, feel free to open an issue to discuss it.
# Install the plugin
$ npm install --save-dev babel-plugin-transform-replace-object-assign
# Install an assign implementation
$ npm install object-assign
When you provide the plugin, use the moduleSpecifier
option to specify which package you would like imported and used when replacing Object.assign
.
.babelrc
{
"plugins": [
["transform-replace-object-assign", { "moduleSpecifier": "object-assign" }]
]
}
To use defaults (which is the same as above):
{
"plugins": ["transform-replace-object-assign"]
}
In
Object.assign(a, b);
Out
import _objectAssign from 'object-assign';
_objectAssign(a, b);
Thanks goes to these wonderful people (emoji key):
Neil Gabbadon 💻 📖 | Ivan Nikolić 🐛 | Jordan Harband 🤔 | Jayden Seric 💻 📖 |
---|
This project follows the all-contributors specification. Contributions of any kind welcome!
FAQs
Allows you to provide custom implementation of Object.assign in babel builds
We found that babel-plugin-transform-replace-object-assign demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.