Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Node
npm install cast
Ender
ender add cast
Usage
var cast = require('cast');
cast('false', 'boolean'); // will return the boolean false
Types in JavaScript can be unpredictable, and trying to protect against the edge-cases is a headache. Consider the following:
Booleans
true === "true" // makes sense false !== "false" // ?? false === "" // ?? true === "0" // ?? or any string
Numbers
isNaN(null) // false isNaN(undefined) // true
There are many others, but these conditions make it very difficult to write truly high-level code. This module tries to solve this problem.
The main use case is simplification of form validation/user input. A single call to cast will eliminate the need to do extensive type-checking.
function cast(val, type[, radix])
instanceof
will be done internallyThere are only two possible return values, null
or something of the type specified by type. Since null cannot be assigned to (as undefined can), this makes complete sense. The first parameter is never modified, so this function truly does no evil.
Arrays
cast([], 'array'); // returns [] (same reference) cast('[]', 'array'); // returns [] (from JSON.parse)
Booleans
cast('true', 'boolean'); // returns true cast('false', 'boolean'); // returns false cast(true, 'boolean'); // returns true cast(false, 'boolean'); // returns false
Integers
cast('10', 'integer'); // returns 10 cast('10c', 'integer'); // returns null cast('10e10', 'integer'); // returns null cast(10, 'integer'); // returns 10 cast('10', 'integer', 8); // returns 8 cast('10', 'integer', '8'); // returns 8 cast('10.1', 'integer', 10); // returns null cast('10.1', 'integer'); // returns null
Floats
cast('5.25', 'float'); // returns 5.25
Strings
cast(5, 'string'); // returns '5' cast(true, 'string'; // returns 'true' cast('hello', 'string'); // returns 'hello' cast({}, 'string'); // returns null cast(undefined, 'string'); // returns null cast(null, 'string'); // returns null cast([], 'string'); // returns null
FAQs
Attempts to solve the problem of unintuitive data types
The npm package cast receives a total of 3 weekly downloads. As such, cast popularity was classified as not popular.
We found that cast demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.