
Research
Security News
Malicious PyPI Package Exploits Deezer API for Coordinated Music Piracy
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
A partial implementation of the W3C DOM API on top of an HTML5 parser and serializer.
browser-x 一个基于 NodeJS 实现的“浏览器”,它实现了浏览器的精华 API,适用于文档或样式节点分析:
npm install browser-x
返回:Promise
var browser = require('browser-x');
var url = __dirname + '/debug.html';
browser({
url: url,
loadCssFile: true,
silent: false
}, function (errors, window) {
if (errors) {
throw errors;
}
var document = window.document;
var element = document.querySelector('#banner h2');
var fontFamily = window.getComputedStyle(element, '::after').fontFamily;
console.log(fontFamily);
});
{
/**
* 文件基础路径
*/
url: 'about:blank',
/*
* HTML 文本内容
*/
html: null,
/**
* 是否支持加载外部 CSS 文件
*/
loadCssFile: false,
/**
* 是否忽略内部解析错误-关闭它有利于开发调试
* @type {Boolean}
*/
silent: true,
/**
* 请求超时限制
* @type {Number} 毫秒
*/
resourceTimeout: 8000,
/**
* 最大的文件加载数量限制
* @type {Number} 数量
*/
resourceMaxNumber: 64,
/**
* 是否缓存请求成功的资源
* @return {Object}
*/
resourceCache: true,
/**
* 映射资源路径
* @param {String} 旧文件地址
* @return {String} 新文件地址
*/
resourceMap: function(file) {
return file;
},
/**
* 忽略资源
* @param {String} 文件地址
* @return {Boolean} 如果返回`true`则忽略当当前文件的加载
*/
resourceIgnore: function(file) {
return false;
},
/**
* 资源加载前的事件
* @param {String} 文件地址
*/
resourceBeforeLoad: function(file) {
},
/**
* 加载远程资源的自定义请求头
* @param {String} 文件地址
* @return {Object}
*/
resourceRequestHeaders: function(file) {
return {
'accept-encoding': 'gzip,deflate'
};
}
}
克隆源码,然后进入源码目录执行:
npm test
browser-x 适合做这些事情:
如果需要更多的 DOM 特性,例如跑基于 DOM 的测试脚本、甚至载入 jQuery 等,那么 jsdom 这个项目可能会更适合你(它唯一没有做好的是样式解析)。
FAQs
A partial implementation of the W3C DOM API on top of an HTML5 parser and serializer.
The npm package browser-x receives a total of 41 weekly downloads. As such, browser-x popularity was classified as not popular.
We found that browser-x demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.
Security News
Newly introduced telemetry in devenv 1.4 sparked a backlash over privacy concerns, leading to the removal of its AI-powered feature after strong community pushback.