
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
comlink-electron-adapter
Advanced tools
[](https://travis-ci.com/kwonoj/comlink-electron-adapter) [](https://ci.appveyor.
Comlink provides way to interface between worker-like endpoint via ES proxy. This module allows to create custom endpoints around Electron's IPC (https://electronjs.org/docs/api/ipc-main) for proxy object across Electron's processes.
This has a peer dependencies of comlink@4, which will have to be installed as well
npm install comlink-electron-adapter
There are separate endpoint creation method per object's origin.
// main process
import { ipcMain } from 'electron';
import { expose } from 'comlink';
import { mainProcObjectEndpoint } from 'comlink-electron-adapter';
const mainProcessObject = {...};
expose(mainProcessObject, mainProcObjectEndpoint(ipcMain));
// renderer process
import { wrap } from 'comlink';
import { ipcRenderer } from 'electron';
// `proxied` is proxy object to `mainProcessObject` in main process
const proxied = wrap(mainProcObjectEndpoint(ipcRenderer));
It is also possible to access renderer process's object in main process.
// renderer process
import { expose } from 'comlink';
import { ipcRenderer } from 'electron';
import { rendererProcObjectEndpoint } from 'comlink-electron-adapter';
const rendererProcessObject = {...};
expose(rendererProcessObject, rendererProcObjectEndpoint(ipcRenderer));
// main process
import { wrap } from 'comlink';
import { ipcMain } from 'electron';
import { rendererProcObjectEndpoint } from 'comlink-electron-adapter';
const rendererProcessWindow = new BrowserWindow();
rendererProcessWindow.loadFile('.../renderer.js');
const proxied = wrap(requestRendererProcessEndpoint(ipcMain, rendererProcessWindow.webContents));
Unlike renderer process main process does not aware target renderer process to send message and target webContents should be specified. Also main process should wait call proxy object until renderer process expose its object.
Due to Electron IPC's design comlink-electron-adapter do not support transferable. Using Comlink.transfer will raise not supported exception.
Few npm scripts are supported for build / test code.
build: Transpiles code to ES5 commonjs to dist.test: Run test cases.lint: Run lint over all codebaseslint:staged: Run lint only for staged changes. This'll be executed automatically with precommit hook.commit: Commit wizard to write commit messageFAQs
[](https://travis-ci.com/kwonoj/comlink-electron-adapter) [](https://ci.appveyor.
The npm package comlink-electron-adapter receives a total of 7 weekly downloads. As such, comlink-electron-adapter popularity was classified as not popular.
We found that comlink-electron-adapter demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.