Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
The 'charm' npm package is a library for manipulating terminal output, allowing you to create dynamic and interactive text-based user interfaces. It provides functionalities for cursor movement, text styling, and screen manipulation.
Cursor Movement
This feature allows you to move the cursor to specific positions on the terminal screen. The code sample demonstrates how to position the cursor at (0, 0) and (10, 10) and write text at those positions.
const charm = require('charm')();
charm.pipe(process.stdout);
charm.position(0, 0);
charm.write('Hello, World!');
charm.position(10, 10);
charm.write('Moved to (10, 10)');
Text Styling
This feature allows you to style text with different colors and attributes. The code sample shows how to change the text color to red and the background color to blue.
const charm = require('charm')();
charm.pipe(process.stdout);
charm.foreground('red');
charm.write('This is red text');
charm.display('reset');
charm.background('blue');
charm.write('This is text with a blue background');
charm.display('reset');
Screen Manipulation
This feature allows you to manipulate the terminal screen, such as clearing it. The code sample demonstrates how to clear the screen and reset the cursor position.
const charm = require('charm')();
charm.pipe(process.stdout);
charm.erase('screen');
charm.position(0, 0);
charm.write('Screen cleared and cursor reset');
Blessed is a comprehensive library for creating interactive command-line interfaces. It offers more advanced features compared to charm, such as support for widgets, forms, and event handling. It is suitable for building complex terminal applications.
Ink is a React-like library for building command-line interfaces. It allows you to use React components to create interactive terminal applications. Ink provides a higher-level abstraction compared to charm, making it easier to build complex UIs.
Ansi-escapes is a library for generating ANSI escape codes for manipulating terminal output. It provides a lower-level API compared to charm, focusing on generating escape codes for cursor movement, text styling, and screen manipulation.
Use ansi terminal characters to write colors and cursor positions.
var charm = require('charm')();
charm.pipe(process.stdout);
charm.reset();
var colors = [ 'red', 'cyan', 'yellow', 'green', 'blue' ];
var text = 'Always after me lucky charms.';
var offset = 0;
var iv = setInterval(function () {
var y = 0, dy = 1;
for (var i = 0; i < 40; i++) {
var color = colors[(i + offset) % colors.length];
var c = text[(i + offset) % text.length];
charm
.move(1, dy)
.foreground(color)
.write(c)
;
y += dy;
if (y <= 0 || y >= 5) dy *= -1;
}
charm.position(0, 1);
offset ++;
}, 150);
Charm objects pass along the data events from their input stream except for events generated from querying the terminal device.
Because charm puts stdin into raw mode, charm emits two special events: "^C" and "^D" when the user types those combos. It's super convenient with these events to do:
charm.on('^C', process.exit)
The above is set on all charm
streams. If you want to add your own handling for these
special events simply:
charm.removeAllListeners('^C')
charm.on('^C', function () {
// Don't exit. Do some mad science instead.
})
Create a new readable/writable charm
stream.
You can pass in readable or writable streams as parameters and they will be
piped to or from accordingly. You can also pass process
in which case
process.stdin
and process.stdout
will be used.
You can pipe()
to and from the charm
object you get back.
Reset the entire screen, like the /usr/bin/reset command.
Emit an "end"
event downstream.
Pass along msg
to the output stream.
Set the cursor position to the absolute coordinates x, y
.
Query the absolute cursor position from the input stream through the output
stream (the shell does this automatically) and get the response back as
cb(x, y)
.
Move the cursor position by the relative coordinates x, y
.
Move the cursor up by y
rows.
Move the cursor down by y
rows.
Move the cursor left by x
columns.
Move the cursor right by x
columns.
Push the cursor state and optionally the attribute state.
Pop the cursor state and optionally the attribute state.
Erase a region defined by the string s
.
s
can be:
Delete 'line'
or 'char'
s. delete
differs from erase
because it does not write over the deleted characters with whitesapce,
but instead removes the deleted space.
mode
can be 'line'
or 'char'
. n
is the number of items to be deleted.
n
must be a positive integer.
The cursor position is not updated.
Insert space into the terminal. insert
is the opposite of delete
,
and the arguments are the same.
Set the display mode with the string attr
.
attr
can be:
Set the foreground color with the string color
, which can be:
or color
can be an integer from 0 to 255, inclusive.
Set the background color with the string color
, which can be:
or color
can be an integer from 0 to 255, inclusive.
Set the cursor visibility with a boolean visible
.
With npm do:
npm install charm
FAQs
ansi control sequences for terminal cursor hopping and colors
The npm package charm receives a total of 1,359,158 weekly downloads. As such, charm popularity was classified as popular.
We found that charm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.