
Research
Security News
Malicious PyPI Package Exploits Deezer API for Coordinated Music Piracy
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
browserize
Advanced tools
Converts simple node.js modules into ES6 modules.
browserize
turns this:
module.exports = function main() {}
const extra = 'EXTRA',
module.exports = {
extra,
}
into this:
export default function main() {}
const extra = 'EXTRA',
export {
extra,
}
main
browserize
turns this:
module.exports = function main() { return true }
const main = require('./main')
module.exports = {
extra: main,
}
into this:
export default function main() { return true }
export {
extra: main,
}
This relies on identical names for the default export in both files.
browserize
turns this:
const common = 'CONSTANT'
module.exports = function main() { return common }
const common = 'CONSTANT'
module.exports = {
extra: common,
}
into this:
const common = 'CONSTANT'
export default function main() { return common }
export {
extra: common,
}
and this:
let common = 'VARIABLE'
module.exports = function main() { return common }
let common = 'VARIABLE'
module.exports = {
extra: common,
}
into this:
let common = 'VARIABLE'
export default function main() { return common }
common = 'VARIABLE'
export {
extra: common,
}
NOTE: Since
browserize
cannot know ifcommon
gets changed inmain.js
, it leaves the assignment in place. If the variable is not assigned in the second file, the declaration is removed.
browserize
does not:
require
s into import
sbrowserize
is made for small packages without runtime dependencies that should run both in node.js and in the browser.
If your package has any dependency, it's probably complex enough to warrant babel, webpack, or some such. Use that instead.
If you need to transpile anything, like CoffeScript or TypeScript, your tooling for that should cover you.
NOTE: If you want to interpolate imports, you need to use the node API. This feature is currently not available for the CLI.
You can import either browserize
or browserize/fs
, depending on how you will use it.
browserize
takes an options object with three optional entries:
main
: a string containing the main/default exportnamed
: a string containing the named exportsimports
: a key/value store that maps import paths to replacement valuesbrowserize/fs
takes an options object with three optional entries:
main
: the file where the main/default export is found, defaults to index.js
, set to null
for no default exportnamed
: where to find the named exports, defaults to null
imports
: a key/value store that maps import paths to replacement file pathsoutput
: where to write the ESM file, defaults to the main
or named
filename with the extension .mjs
And that is it.
const browserizeFS = require('browserize/fs')
browserizeFS()
This reads index.js
and writes the equivalent index.mjs
, and that's it.
const fs = require('fs-extra')
const browserize = require('browserize')
const main = fs.readFileSync('main.js').toString()
browserize({ main })
Turns the content of main.js
into its ESM version.
This is mainly useful if you want to integrate with a build setup using in-memory files, like gulp
.
browserize/fs
coversconst browserizeFS = require('browserize/fs')
browserizeFS({
main: 'components/class-name.jsx',
named: 'extras/helpers/component-helpers.js',
output: 'dist/browser-magic.js',
imports: {
'../utils': 'utils.js',
'../../utils': 'utils.js',
},
})
This includes named exports, sets custom paths for everything, and interpolates an import into both import files.
build.js |
|
---|---|
src/main.js |
|
src/constant.js |
|
result |
|
Using this feature, you can extract constants for common use in node files and still have an ESM file without dependencies.
IMPORTANT: The keys are matched verbatim, so
imports:{'./x':'X'}
will do nothing forrequire('./x.js')
.
NOTE: This only works for simple values, like strings and arrays, not functions or classes.
npx browserize [--no-default|-x] [[--default|-d] index.js] [[--named|-n] helpers.js] [[--output|-o] index.mjs]
The CLI passes the given arguments through to the underlying node API, and works through browserize/fs
.
npx browserize
This reads index.js
and writes the equivalent index.mjs
, and that's it.
npm browserize -n helper-functions
This reads index.js
and helper-functions.js
, then transforms and concatenates them, and finally writes the result to index.mjs
.
browserize
coversnpx browserize class-name.jsx helper-functions.js dist/browser-magic.js
This includes named exports and sets custom paths for everything.
browserize
is a simple tool and has a few simple requirements:
module.exports
module.exports = class DefaultExport {}
module.exports = {
key1: helper1,
key2: helper2,
}
exports.key1 = helper1
exports.key2 = helper2
While valid, browserize
does not know how to transform this.
module.exports = export1
module.exports = export2
This is not useful anyway.
window.myStuff = class DefaultExport {}
This is not a module.
module.exports = class DefaultExport {}
module.exports = class DefaultExport {
}
module.exports =
class DefaultExport {}
While this is valid in node.js, it will lead to an invalid ESM file.
module.exports = { helper1, helper2 }
module.exports = {
helper1,
helper2,
}
module.exports.helper1 = helper1
module.exports.helper2 = helper2
While this is valid in node.js, browserize
does not understand it.
This is too complex, and has no real benefit over the object literal.
module.exports = {
helper1,
helper2,
}
module.exports = {
helper1: helper1,
helper2: helper2,
}
module.exports = {
key1: helper1,
key2: helper2,
}
While this is valid in node.js, it will lead to an invalid ESM file.
FAQs
Converts simple node.js modules into ES6 modules
We found that browserize demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.
Security News
Newly introduced telemetry in devenv 1.4 sparked a backlash over privacy concerns, leading to the removal of its AI-powered feature after strong community pushback.