Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
bagel-module-loader
Advanced tools
bagel-module-loader
contains all module loading logic for bagel.
npm install --save bagel-module-loader
import createLoader from 'bagel-module-loader';
// initialize loader
const load = createLoader({resolvers: [testResolver]});
// If desired, assemble some context data which will be accessible at multiple points during the module load process
const context = {foo: 'foo'};
// load some modules!
const loaded = load('foo', __dirname, {});
{
// list of module resolvers for custom resolving
resolvers?: Array<Resolver>,
// list of methods to perform an action before default require() is called
interceptors?: Array<Interceptor>,
// list of methods to convert source code
sourceCodeTransformers?: Array<Transformer>,
// method to wrap the module being served
wrapModule?: source: string => result: string,
// method to customize cache key generation within bagel
generateModuleCacheKey?: GenerateModuleCacheKey,
}
A number of the hooks in the module loader provide access to a context object which can be passed in with each call to the modoule loader. The core bagel module supplies a JobHandlerRequest as context.
({ jobRequest, parentBatchRequest, jobResponseMetadata, batchResponseMetadata }: JobHandlerRequest)
type Resolver = (
dependencyID: string,
from: string,
requestContext: {}
) => string | null;
Bagel's resolve method loops through the resolvers provided, falling back on default node resolution if none of the provided resolvers are able to resolve the module.
type Interceptor = ({
moduleID: string,
requestContext: {[string]: any},
next: string => any
}) => any;
Interceptors allow developers to tap into the module loading process. In the process of loading a module, bagel will sequentially step through the interceptors supplied before the actual 'require' function is invoked.
These methods have access to a specific job's moduleID, requestContext
and next
. Interceptors can modify the requestContext supplied and can invoke next()
to delegate to the next interceptor in the chain. Interceptors can also short-circuit the module loading process by returning early. These two flows are illustrated in the diagram above.
type Transformer = ({path: string, source: string}) => {
errors: Array<string>,
transformedSource: string
};
Provide a source code transformer if you would like to transform the initial module source code.
Pass in your own wrapper function if you would like to customize how a module is wrapped before it is loaded.
type GenerateModuleCacheKey = ({
moduleID: string,
requestContext: Object,
pathToSourceFile: string
}) => string | null;
// ie)
({moduleID}) => `${moduleID}_${pretendCacheBuster}`;
bagel-module-loader
caches compiled source code. If a cache key isn't found, the source code will be loaded from disk in the course of loading the module. generateModuleCacheKey
is a method to generate these cache keys.
FAQs
Flexible module loader
We found that bagel-module-loader demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.