Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
caching-transform
Advanced tools
The caching-transform npm package is designed to cache the results of expensive transformation operations, such as those performed during the build or compilation process. It works by storing the results of these operations in a cache, keyed by a hash of the input. This means that if the input hasn't changed, the transformation can be skipped, and the cached result can be used instead. This can significantly speed up build times in development environments or for repeated builds.
Caching file transformations
This code demonstrates how to use caching-transform to cache the results of a file transformation. The `transform` function represents an expensive operation. The `cache` function, created by `cachingTransform`, checks if a cached result exists for the given input. If not, it runs the transformation and caches the result.
const cachingTransform = require('caching-transform');
const fs = require('fs');
const path = require('path');
const cacheDir = path.join(__dirname, '.cache');
const transform = (input) => {
// Perform an expensive transformation here
return transformedInput;
};
const cache = cachingTransform({
cacheDir: cacheDir,
transform: transform
});
const input = fs.readFileSync('input.txt', 'utf8');
const output = cache(input);
console.log(output);
babel-loader is a Webpack plugin that transpiles JavaScript files using Babel and caches the results. While caching-transform is a more generic tool that can be used with any transformation function, babel-loader is specifically designed for use with Webpack and Babel.
cache-loader is another Webpack loader that caches the result of expensive operations. It is similar to caching-transform in its purpose of caching transformation results to speed up build processes. However, cache-loader is specifically tailored for Webpack's ecosystem.
hard-source-webpack-plugin is a plugin for Webpack that provides an intermediate caching step for modules. Like caching-transform, it aims to speed up build times by caching the results of expensive operations. However, it is tightly integrated with Webpack's architecture and caching strategy.
Wraps a transform and provides caching.
Caching transform results can greatly improve performance. nyc
saw dramatic performance increases when we implemented caching.
$ npm install caching-transform
const cachingTransform = require('caching-transform');
const transform = cachingTransform({
cacheDir: '/path/to/cache/directory',
salt: 'hash-salt',
transform: (input, metadata, hash) => {
// ... Expensive operations ...
return transformedResult;
}
});
transform('some input for transpilation')
// => fetch from the cache,
// or run the transform and save to the cache if not found there
Returns a transform callback that takes two arguments:
input
a string to be transformedmetadata
an arbitrary data objectBoth arguments are passed to the wrapped transform. Results are cached in the cache directory using an sha256
hash of input
and an optional salt
value. If a cache entry already exist for input
, the wrapped transform function will never be called.
Type: string
Buffer
Default: ''
A value that uniquely identifies your transform:
const pkg = require('my-transform/package.json');
const salt = pkg.name + ':' + pkg.version;
Including the version in the salt ensures existing cache entries will be automatically invalidated when you bump the version of your transform. If your transform relies on additional dependencies, and the transform output might change as those dependencies update, then your salt should incorporate the versions of those dependencies as well.
Type: Function(input: string|Buffer, metadata: *, hash: string): string|Buffer
input
: The value to be transformed. It is passed through from the wrapper.metadata
: An arbitrary data object passed through from the wrapper. A typical value might be a string filename.hash
: The salted hash of input
. Useful if you intend to create additional cache entries beyond the transform result (i.e. nyc
also creates cache entries for source-map data). This value is not available if the cache is disabled, if you still need it, the default can be computed via hasha([input, salt])
.The transform function will return a string
(or Buffer if encoding === 'buffer'
) containing the result of transforming input
.
Type: Function(cacheDir: string): transformFunction
If the transform
function is expensive to create, and it is reasonable to expect that it may never be called during the life of the process, you may supply a factory
function that will be used to create the transform
function the first time it is needed.
A typical usage would be to prevent eagerly require
ing expensive dependencies like Babel:
function factory() {
// Using the factory function, you can avoid loading Babel until you are sure it is needed.
const babel = require('babel-core');
return (code, metadata) => {
return babel.transform(code, {filename: metadata.filename, plugins: [/* ... */]});
};
}
Required unless caching is disabled
Type: string
The directory where cached transform results will be stored. The directory is automatically created with mkdirp
. You can set options.createCacheDir = false
if you are certain the directory already exists.
Type: string
Default: ''
An extension that will be appended to the salted hash to create the filename inside your cache directory. It is not required, but recommended if you know the file type. Appending the extension allows you to easily inspect the contents of the cache directory with your file browser.
Type: Function(input: string|Buffer, additionalData: *)
Default: Always transform
A function that examines input
and metadata
to determine whether the transform should be applied. Returning false
means the transform will not be applied and input
will be returned unmodified.
Type: boolean
Default: false
If true
, the cache is ignored and the transform is used every time regardless of cache contents.
Type: Function(input: string|Buffer, metadata: *): string|Buffer|Array[string|Buffer]
Provide additional data that should be included in the hash.
One potential use is including the metadata
in the hash by coercing it to a hashable string or buffer:
function hashData(input, metadata) {
return JSON.stringify(metadata);
}
(Note that metadata
is not taken into account otherwise.)
Type: Function(metadata: *): string
Provide a filename to prefix the cache entry. The return value may not contain any path separators.
function filenamePrefix(metadata) {
return path.parse(metadata.filename || '').name + '-';
}
Type: Function(input: string|Buffer, metadata: *, hash: string)
Function that is called after input is hashed.
Type: string
Default: 'utf8'
The encoding to use when writing to / reading from the filesystem. If set it to buffer
, then buffers will be returned from the cache instead of strings.
MIT © James Talmage
FAQs
Wraps a transform and provides caching
The npm package caching-transform receives a total of 3,719,319 weekly downloads. As such, caching-transform popularity was classified as popular.
We found that caching-transform demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.