Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
npm i datetoken
Most probably you will be dealing with simple presets such as yesterday or the last 24 hours.
>>> const datetoken = require('datetoken');
>>> console.log(new Date())
2018-10-18 14:08:47
>>> datetoken('now-d/d') # Start of yesterday
2018-10-17 00:00:00
>>> datetoken('now-d@d') # End of yesterday
2018-10-17 23:59:59
This package aims to solve a set of needs present in applications where dates need to be represented in a relative fashion, like background periodic tasks, datetime range pickers... in a compact and stringified format. This enables the programmer to persist these tokens during the lifetime of a process or even longer, since calculations are performed in the moment of evaluation. Theses tokens are also useful when caching URLs as replacement of timestamps, which would break caching given their mutability nature.
Some common examples of relative tokens:
From | To | |
---|---|---|
Today | now/d | now |
Yesterday | now-d/d | now-d@d |
Last 24 hours | now-24h | now |
Last business week | now-w/bw | now-w@bw |
This business week | now/bw | now@bw |
Last month | now-1M/M | now-1M@M |
Next week | now+w/w | now+w@w |
Custom range | now+w-2d/h | now+2M-10h |
Last month first business week | now-M/M+w/bw | now-M/+w@bw |
This year | now/Y | now@Y |
This quarter | now/Q | now@Q |
First quarter (Q1) | now/Q1 | now@Q1 |
Second quarter (Q2) | now/Q2 | now@Q2 |
Third quarter (Q3) | now/Q3 | now@Q3 |
Fourth quarter (Q4) | now/Q4 | now@Q4 |
As you may have noticed, token follow a pattern:
The word now
. It means the point in the future timeline when tokens are
parsed to their datetime form.
Optionally, modifiers to add and/or subtract the future value of now
can
be used. Unsurprisingly, additions are set via +
, while -
mean
subtractions. These modifiers can be chained as many times as needed.
E.g: now-1M+3d+2h
. Along with the arithmetical sign and the amount, the
unit of time the amount refers to must be specified. Currently, the supported
units are:
s
secondsm
minutesh
hoursd
daysw
weeksM
monthsY
yearsQ
quartersOptionally, there exist two extra modifiers to snap dates to the start or the end of any given snapshot unit. Those are:
/
Snap the date to the start of the snapshot unit.@
Snap the date to the end of the snapshot unit.Snapshot units are the same as arithmetical modifiers, plus bw
, meaning
business week. With this, we achieve a simple way to define canonical
relative date ranges, such as Today or Last month. As an example of
the later:
now-1M/M
, now-1M@M
FAQs
Parse relative datetime tokens into date objects
The npm package datetoken receives a total of 4,460 weekly downloads. As such, datetoken popularity was classified as popular.
We found that datetoken demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.