Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Some functions throw errors. Maybe you don't care about any errors. The show must go on.
Maybe you do this:
let data: string | undefined
try {
data = getSomeString()
} catch () {
// Silently ignore the error.
// We don't really need the data anyway.
}
That's a lot of lines.
We can do better
Introducing catches
const data = catches(getSomeString) // => string | undefined
It's that easy
There's more!
// want to fallback if the function throws? easy
const data = catches(getSomeString) ?? "fallback" // => string
// what if the function is synchronous?
// what if it is async?
// and what if the promise is rejected
// and what if the function throws even before a promise is returned
// ...
// what do you think?
// of course it still works
const data = await catches(async () => "...") ?? "fallback"
// wait. but what if my function needs arguments?
// well. just add them at the end
const data = catches(getSomeString, 1, 2)
// easy
npm install catches
# stop
# are you srsly using npm
# it's 2024 (or later)
bun i catches # (note: not a real command)
# don't like bun?
# well lucky you
# this is javascript
yarn add catches
pnpm i catches
oro add catches
I mean. It's kinda done right? There's nothing left here. Stop reading, go use catches
, save yourself some time, spend it with your family. You won't get this time back. I'm serious. Look outside. What a beautiful day. Now look at this README. Do you really want to contribute to this? I mean...
But no, seriously. If you do want to contribute. Please do. I'd love that.
This project is licensed under the GPL v3 or Later.
FAQs
Catch errors and return a fallback instead
We found that catches demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.