Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
The callsites npm package provides a way to get call sites of the V8 stack trace API in Node.js. It allows developers to inspect the call stack and retrieve information about the function calls that led to a certain point in the code.
Getting call sites
This feature allows you to retrieve an array of call sites (stack frames) at the point where callsites() is invoked. Each call site is an object with methods that return information about that call site, such as the file name, line number, and column number.
const callsites = require('callsites');
function foo() {
const sites = callsites();
console.log(sites[0].getFileName()); // => '/path/to/file.js'
}
foo();
Inspecting call stack
This feature is used to inspect the call stack and get names of the calling functions. It can be useful for debugging or for understanding the flow of function calls leading up to a certain point.
const callsites = require('callsites');
function foo() {
bar();
}
function bar() {
const sites = callsites();
console.log(sites.map(site => site.getFunctionName() || 'anonymous'));
}
foo();
The stack-trace package provides similar functionality to callsites by allowing developers to get stack traces and extract detailed information about each stack frame. It differs in its API and additional features for parsing and formatting stack traces.
This package is used to parse and extract stack traces from Error objects. It provides a different API but serves a similar purpose in allowing inspection of the call stack. It focuses more on parsing standardized Error stack strings.
Trace is a package that enhances error stack traces. While it does not provide the same direct API for getting call sites, it offers a way to have long stack traces that can be useful for debugging asynchronous code.
Stackman is another package that can be used to retrieve and manipulate stack traces. It provides rich stack traces with context and source maps support, which can be more informative than the basic call site information provided by callsites.
Get callsites from the V8 stack trace API
npm install callsites
import callsites from 'callsites';
function unicorn() {
console.log(callsites()[0].getFileName());
//=> '/Users/sindresorhus/dev/callsites/test.js'
}
unicorn();
Returns an array of callsite objects with the following methods:
getThis
: Returns the value of this
.getTypeName
: Returns the type of this
as a string. This is the name of the function stored in the constructor field of this
, if available, otherwise the object's [[Class]]
internal property.getFunction
: Returns the current function.getFunctionName
: Returns the name of the current function, typically its name
property. If a name property is not available an attempt will be made to try to infer a name from the function's context.getMethodName
: Returns the name of the property of this
or one of its prototypes that holds the current function.getFileName
: If this function was defined in a script returns the name of the script.getLineNumber
: If this function was defined in a script returns the current line number.getColumnNumber
: If this function was defined in a script returns the current column numbergetEvalOrigin
: If this function was created using a call to eval
returns a string representing the location where eval
was called.isToplevel
: Returns true
if this is a top-level invocation, that is, if it's a global object.isEval
: Returns true
if this call takes place in code defined by a call to eval
.isNative
: Returns true
if this call is in native V8 code.isConstructor
: Returns true
if this is a constructor call.isAsync()
: Returns true
if this call is asynchronous (i.e. await
, Promise.all()
, or Promise.any()
).isPromiseAll()
: Returns true
if this is an asynchronous call to Promise.all()
.getPromiseIndex()
: Returns the index of the promise element that was followed in Promise.all()
or Promise.any()
for async stack traces, or null
if the CallSite
is not an asynchronous Promise.all()
or Promise.any()
call.FAQs
Get callsites from the V8 stack trace API
The npm package callsites receives a total of 39,412,723 weekly downloads. As such, callsites popularity was classified as popular.
We found that callsites demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.