
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
basisjs-tools-instrumenter
Advanced tools
JavaScript source code location instrumenter for basisjs-tools
Source code instrumenting plugin for basisjs-tools. Based on Babel and babel-plugin-source-wrapper.
npm install basisjs-tools-instrumenter
NOTE:
basisjs-tools1.5 or highest is required.
Add to basis.config those settings:
{
"plugins": [
"basisjs-tools-instrumenter"
]
}
That's all!
You could pass additional parameters for plugin:
{
"plugins": [
{
"name": "basisjs-tools-instrumenter",
"ignore": [
"build/**"
],
"options": {
"registratorName": "youOwnName",
"blackbox": ["/build/**"]
}
}
]
}
By ignore option we set of file path masks (minimatch is used) that should not to be instrumented.
All options are optional.
String$devinfoSet custom name for API.
Array or false["/bower_compontents/**", "/node_modules/**"]List of minimatch masks for source filenames, which dev info should be marked as blackbox. Info with blackbox: true has lower priority and overrides by info without this marker.
This plugins process all .js files and modify (instrument) code to provide location information about some object or function later, i.e. answer to question where value was defined. Let's look for simple example:
var a = {
foo: 1,
bar: function(){
return 123;
}
};
It will be instrumented to:
var a = $devinfo({
foo: 1,
bar: $devinfo(function () {
return 123;
}, {
loc: "filename:3:8:5:4"
})
}, {
loc: "filename:1:9:6:2",
map: {
foo: "filename:2:8:2:9",
bar: "filename:3:8:5:4"
}
});
//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJzZWN0aW9ucyI6…AxLFxuICBiYXI6IGZ1bmN0aW9uKCl7XG4gICAgcmV0dXJuIDEyMztcbiAgfVxufTsiXX19XX0=
As you can see, some expressions was wrapped by function $devinfo() (default name, but you can set it via registratorName option). This function returns first argument as is. But associates (attach) second argument (meta data) to first argument. WeakMap is used for that.
Meta data contains infomation about wrapped expression range in source (loc property). It can store additional infomation in some cases, e.g. map of object value ranges for object literals.
Since instrumentation corrupt original code plugin adds source map to result. It means you'll see original source in browser's developer tools instead of instrumented.
It also process .html files to inject required API to global scope, and adds reference to those API to basisjs-config if any found.
Registraction function has additional methods:
set(ref, data) - it's alias for wrapping function, allows attach data (some meta info) to ref; if ref has already some info, function overrides itget(ref) - return meta info attached to ref, if anyvar obj = {};
$devinfo(obj, { someInfo: 123 });
// or
$devinfo.set(obj, { someInfo: 123 });
console.log($devinfo.get(obj));
// { someInfo: 123 }
Plugin can be used with webpack. In this case webpack should instrument source code by Babel and babel-plugin-source-wrapper and basisjs-tools-instrumenter should do everything else except instrumenting.
Settings for Babel in webpack.config.js:
module.exports = {
// ...
babel: {
sourceMaps: true, // source maps are required
plugins: [
// in case you use React, this plugin should be applied
// before babel-plugin-source-wrapper
// otherwise component names will not to be shown propertly
require('babel-plugin-react-display-name'),
// plugin to instrument source code
require('babel-plugin-source-wrapper')({
// webpack sends absolute paths to plugins
// but we need paths relative to project root
basePath: process.cwd()
})
]
}
};
Disallow instrumenting for basisjs-tools-instrumenter in basis.config:
{
"plugins": [
{
"name": "basisjs-tools-instrumenter",
"ignore": ["**/*.js"]
}
]
}
FAQs
JavaScript source code location instrumenter for basisjs-tools
The npm package basisjs-tools-instrumenter receives a total of 4 weekly downloads. As such, basisjs-tools-instrumenter popularity was classified as not popular.
We found that basisjs-tools-instrumenter demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.