
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Fakes commonJS boilerplate to allow importing legacy code as an ES6 module
cjs-faker fakes commonJS and AMD boilerplate to allow importing legacy code via ES6 modules.
This is implemented by providing fake exports
/module.exports
, require()
and define()
calls that are used by the commonJS or AMD code being included.
You must shim all modules that you depend on.
This approach is mostly a thought experiment in evaluating legacy code at runtime, rather than requiring a build step (as require()
and define()
are not supported natively by browsers).
For most practical purposes, you'll be better off using Rollup with its commonJS plugin. Using Rollup requires a build step before you can import legacy code as an ES6 module, but doesn't require a shim per module in the dependency tree.
Usage requires providing a shim around all commonJS or AMD modules:
// wrap_base64.js
import faker from './node_modules/cjs-faker/cjs-faker.js';
import 'https://cdn.rawgit.com/mathiasbynens/base64/a8d7cabd/base64.js';
export default faker('base64');
Now you can just use the base64
module inside ES6:
import base64 from './wrap_base64.js';
console.info(base64.encode('Hello!'));
// or use require() itself for already wrapped modules
const base64 = require('base64');
No build steps are required.
If you depend on commonJS module A, which depends on commonJS module B etc, you must provide the shim for B first, then A.
The default faker
method in the examples fills a registry that is available via the global require()
call, so B has to be shimmed first for A's require('a')
call to succeed.
See file B:
// wrap_b.js
import faker from './node_modules/cjs-faker/cjs-faker.js';
import './path/to/b.js';
export default faker('b');
And file A:
// wrap_a.js
import faker from './node_modules/cjs-faker/cjs-faker.js';
import './path/to/a.js';
export default faker('a');
FAQs
Fakes commonJS boilerplate to allow importing legacy code as an ES6 module
The npm package cjs-faker receives a total of 2 weekly downloads. As such, cjs-faker popularity was classified as not popular.
We found that cjs-faker demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.