
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
can-derive
Advanced tools
can-derive is a plugin that creates observable filtered lists that stay up-to-date with a source list.
For example, a todo list might contain todo objects with a completed property.
Traditionally can.List.filter enables you to create a new can.List
containing only the "completed" todo objects. However, if the source list were
to change in any way - for instance via an "add" or "remove" - the returned
can.List may become an innaccurate representation of the source list.
The same filtered list of "completed" todo objects created
with can-derive's can.List.dFilter would always be an accurate
representation of with the source, no matter how it was manipulated.
can-derive is ideal for cases where the source list contains at least 10 items and is expected to be "changed" frequently (3 or more times).
See it in action on JSBin.
Use npm to install can-derive:
npm install can-derive --save
Use require in Node/Browserify workflows to import the can-derive plugin
like:
require('can-derive');
Use define, require, or import in StealJS workflows
to import the can-derive plugin like:
import 'can-derive';
Once you've imported can-derive into your project, simply use
can.List.dFilter to generate a derived list based on a predicate function.
The following example derives a list of completed items from a todo list:
var sourceList = new can.List([
{ name: 'Hop', complete: true },
{ name: 'Skip', complete: false },
//...
]);
var completed = sourceList.filter(function(todo) {
return todo.attr("complete") === true;
});
Any changes to sourceList will automatically update the derived completed
list:
completed.bind('add', function(ev, newItems) {
console.log(newItems.length, 'item(s) added');
});
sourceList.push({ name: 'Jump', complete: true },
{ name: 'Sleep', complete: false }); //-> "1 item(s) added"
If you're using the can.Map.define plugin, you can define a derived list like so:
{
define: {
todos: {
Value: can.List
},
completedTodos: {
get: function() {
return this.attr('todos').dFilter(function(todo){
return todo.attr('complete') === true;
});
}
}
}
}
Note: The can-derive plugin ensures that the define plugin's get method will
not observe "length" like it would a traditional can.List
when calling .filter().
Unlike can.List and Array, indexes of a FilteredList cannot be
accessed using bracket notation:
filteredList[1]; //-> undefined
To access a FilteredList's values, use .attr():
filteredList.attr(); //-> ["a", "b", "c"]
filteredList.attr(0); //-> "a"
filteredList.attr(1); //-> "b"
filteredList.attr(2); //-> "c"
filteredList.attr('length'); //-> 3
This is due to the fact that a FilteredList inherits a can.RBTreeList
and stores its values in a Red-black tree
for performance - rather than a series of numeric keys.
sourceList.filter(predicateFn) -> FilteredList
Similar to .filter() except
that the returned FilteredList is bound to sourceList.
Returns a FilteredList.
Since FilteredList inherits from can.RBTreeList,
the following methods are available:
.attr().each().eachNode().filter().indexOf().indexOfNode().map().slice() (coming soon)A FilteredList is bound to its source list and manipulted as it changes.
Because of this, it is read-only and the following can.RBTreeList
methods are disabled:
.push().pop().removeAttr().replace().shift().splice().unshift()can-derive optimizes for insertions and removals, completing them in O(log n)
time. This means that changes to the source list will automatically update the
derived list in O(log n) time, compared to the standard O(n) time you would
expect in other implementations.
It does this by:
This algorithm was originally discussed in [this StackExchange thread](http://cs.stackexchange.com/questions/43447/order-preserving-update-of-a -sublist-of-a-list-of-mutable-objects-in-sublinear-t/44502#44502).
In general, it is preferable to use can-derive over alternative approaches
when:
To set up your dev environment:
npm install.list/test.html in your browser. Everything should pass.npm test. Everything should pass.npm run-script build. Everything should build okFAQs
Derive a list/map from another via live binding
The npm package can-derive receives a total of 0 weekly downloads. As such, can-derive popularity was classified as not popular.
We found that can-derive demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.