Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Grab the color palette from an image using just Javascript.Works in the browser and in Node.
build/
- Simple script that copies and renames files into the /dist folder.cypress/
- Browsers tests.dist/
- Generated distribution files created by microbundle package and a couple of files copied via build script.examples/
- CSS, JS, and Images for the index.html example page.src/color-thief-node.js
- Source for the Node (commonjs) compatible version of the script.src/color-thief.js
- Source for the browser (ES6, AMD, Global var) compatible version of the script.src/core.js
- Functions shared between the node and browser versions of the script.test/
- Node integration tests. Uses Chai.index.html
- Example page.There are two sets of tests:
To run both the browser and Node tests:
npm run dev
to start local server.npm run test
then run tests in a separate processTo run just the browser tests with the Cypress UI:
npm run dev
to start local servernpm run test:browser
ornpm run cypress
to view the Cypress UITo run just the Node tests:
npm run test:node
cypress/test-pages/index.html
as needed or create a new test page if you need new examples.cypress/integration/apis_spec.js
dev
into master
master
src/color-thief.js
and package.json
package-lock.json
and then install depsnpm run build
npm run dev
and npm run test
master
v2.8.1
npm publish
FAQs
Get the dominant color or color palette from an image.
The npm package colorthief receives a total of 54,276 weekly downloads. As such, colorthief popularity was classified as popular.
We found that colorthief demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.