
Research
Security News
Malicious PyPI Package Exploits Deezer API for Coordinated Music Piracy
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
A partial implementation of the W3C DOM API on top of an HTML5 parser and serializer.
这是一个基于 NodeJS 实现的“浏览器”,它实现了 DOM 的一些基础 API 可供开发人员使用。你可以:
npm install browser-x
var browser = require('browser-x');
var baseURI = __dirname + '/debug.html';
var html = fs.readFileSync(baseURI, 'utf8');
browser({
html: html,
baseURI: baseURI,
loadCssFile: true,
silent: false
}, function (errors, window) {
if (errors) {
throw errors;
}
var document = window.document;
var element = document.querySelector('#banner h2');
var fontFamily = window.getComputedStyle(element, '::after').fontFamily;
console.log(fontFamily);
});
var browser = require('browser-x');
browser.open('http://font-spider.org', {
loadCssFile: true,
silent: false
}, function (errors, window) {
if (errors) {
throw errors;
}
console.log(window.document.title);
});
browser() 与 browser.open() 均返回
Promise
对象
{
/**
* 文件基础路径
*/
baseURI: 'about:blank',
/**
* 是否支持加载外部 CSS 文件
*/
loadCssFile: false,
/**
* 解析时是否静默失败
* @type {Boolean}
*/
silent: true,
/**
* 请求超时限制
* @type {Number} 毫秒
*/
resourceTimeout: 5000,
/**
* 最大的文件加载数量限制
* @tyoe {Number} 数量
*/
resourceMaxNumber: 64,
/**
* 映射资源路径
* @param {String} 旧文件地址
* @return {String} 新文件地址
*/
resourceMap: function(file) {
return file;
},
/**
* 忽略资源
* @param {String} 文件地址
* @return {Boolean} 如果返回`true`则忽略当当前文件的加载
*/
resourceIgnore: function(file) {
return false;
},
/**
* 资源加载前的事件
* @param {String} 文件地址
*/
resourceBeforeLoad: function(file) {
},
/**
* 加载远程资源的自定义请求头
* @param {String} 文件地址
* @return {Object}
*/
resourceRequestHeaders: function(file) {
return {
'accept-encoding': 'gzip,deflate'
};
}
}
npm test
browser-x 适合做这些事情:
如果需要更多的 DOM 特性,例如跑基于 DOM 的测试脚本、甚至载入 jQuery 等,那么 jsdom 这个项目可能会更适合你(它唯一没有做好的是样式解析)。
FAQs
A partial implementation of the W3C DOM API on top of an HTML5 parser and serializer.
The npm package browser-x receives a total of 41 weekly downloads. As such, browser-x popularity was classified as not popular.
We found that browser-x demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.
Security News
Newly introduced telemetry in devenv 1.4 sparked a backlash over privacy concerns, leading to the removal of its AI-powered feature after strong community pushback.