Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Bun is a fast all-in-one JavaScript runtime, bundler, transpiler, and package manager. It aims to provide a comprehensive toolset for modern JavaScript development, focusing on performance and developer experience.
JavaScript Runtime
Bun can execute JavaScript code directly, similar to Node.js. This makes it suitable for running scripts and building server-side applications.
console.log('Hello, Bun!');
Bundler
Bun can bundle JavaScript and TypeScript files, optimizing them for production. This command takes an entry file and outputs the bundled code to a specified directory.
bun build src/index.js --outdir dist
Transpiler
Bun can transpile TypeScript to JavaScript, making it easier to work with modern JavaScript features while maintaining compatibility with older environments.
bun transpile src/index.ts --outdir dist
Package Manager
Bun includes a package manager that can install dependencies from the npm registry. This command installs the React library into your project.
bun install react
Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. It is widely used for building server-side applications and has a vast ecosystem of packages. Compared to Bun, Node.js is more mature and has broader community support, but it may not be as fast in certain scenarios.
Webpack is a popular module bundler for JavaScript applications. It allows developers to bundle JavaScript files for usage in a browser. While Webpack is highly configurable and powerful, it can be complex to set up compared to Bun's simpler bundling process.
Esbuild is an extremely fast JavaScript bundler and minifier. It is known for its speed and efficiency, making it a strong competitor to Bun in terms of performance. However, Esbuild focuses primarily on bundling and minification, whereas Bun offers a broader range of features.
TypeScript is a superset of JavaScript that adds static types. While Bun can transpile TypeScript to JavaScript, TypeScript itself is a language and compiler that provides type safety and modern JavaScript features. Bun's transpiler feature is similar but integrated into its all-in-one toolset.
Npm is the default package manager for Node.js. It is used to install, share, and manage dependencies in JavaScript projects. Bun's package manager aims to be faster and more efficient, but npm has a larger ecosystem and is more widely adopted.
We've all pondered, "But what do I do with it?" The answer is universal: Wrap it
in a bun! bun wraps a series of streams into a single
stream.Duplex
-compliant unit.
Say you have an existing module with an implentation like this
// my-transport.js
encryptor.pipe(compressor).pipe(socket).pipe(decompressor).pipe(decryptor);
Totally believable, right? Now each time someone wants to use your module, you have to do something like this
// too much work!
client.pipe(encryptor)
.pipe(compressor)
.pipe(socket)
.pipe(decompressor)
.pipe(decryptor)
.pipe(client);
Gross! Puke! This is horribly inconvenient and ugly for the end user! Let's look at a better solution
// defined in my-transport.js
var bun = require("bun");
module.service = function(socket) {
return bun([encryptor, compressor, socket, decompressor, decryptor]);
});
// used in client
var transport = require("./my-transport");
client.pipe(transport.service(socket)).pipe(client);
Hot cross buns! bun is amazing!
var stream = require("stream"),
bun = require("bun");
// stream generator
var createStream = function createStream(id) {
var s = new stream.Transform({encoding: "utf8"});
s._transform = function _transform(str, encoding, done) {
this.push("(" + id + " " + str + ")");
done();
};
return s;
};
// create some streams
var streams = ["G", "O", "D"].map(function(id) {
return createStream(id);
});
// wrap the streams in a bun!
var hotdog = bun(streams);
// connect hotdog to stdout
hotdog.pipe(process.stdout);
// use the hotdog
hotdog.write("in a bun"); // (D (O (G in a bun)))
Buns are convenient, edible, and keep your hands clean! Use bun!
bun
var service = bun(streams, [options]);
stream
objects.Options:
true
.FAQs
Bun is a fast all-in-one JavaScript runtime.
The npm package bun receives a total of 127,978 weekly downloads. As such, bun popularity was classified as popular.
We found that bun demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.